Handmade Marketplace App Creema For Android
Monthly
Open redirect in the Creema handmade marketplace mobile apps for Android and iOS lets a crafted URL cause the app to render an attacker-controlled web page inside its own in-app screen, enabling convincing phishing pages that appear to originate from a trusted app. The flaw requires the victim to actively open a malicious link (UI:A/UI:R) and no authentication is needed (PR:N), but impact is limited to integrity of displayed content (C:N/I:L/A:N), with no code execution or direct data compromise; CVSS base score is 5.1 (medium). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), though JPCERT/CC has published the issue as JVN48627289 and users of both platform apps are exposed regardless of app version because the vendor CPE entries are version-agnostic.
Open redirect in the Creema handmade marketplace mobile apps for Android and iOS lets a crafted URL cause the app to render an attacker-controlled web page inside its own in-app screen, enabling convincing phishing pages that appear to originate from a trusted app. The flaw requires the victim to actively open a malicious link (UI:A/UI:R) and no authentication is needed (PR:N), but impact is limited to integrity of displayed content (C:N/I:L/A:N), with no code execution or direct data compromise; CVSS base score is 5.1 (medium). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), though JPCERT/CC has published the issue as JVN48627289 and users of both platform apps are exposed regardless of app version because the vendor CPE entries are version-agnostic.