CVE-2025-41408
BaseFortify
Publication date: 2025-09-05
Last updated on: 2025-09-05
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ly_corporation | yahoo_shopping | 14.15.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-939 | The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is specific to the Yahoo! Shopping App for Android versions prior to 14.15.0 and involves improper authorization in the handler for custom URL schemes. Detection would involve checking the installed version of the Yahoo! Shopping app on Android devices. There are no specific network detection commands provided. To detect the vulnerable app version, you can check the app version on the device using Android commands such as 'adb shell dumpsys package jp.co.yahoo.android.shopping | grep versionName'. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Yahoo! Shopping App for Android to version 14.15.0 or later, as provided by the developer. This update addresses the improper authorization vulnerability in the custom URL scheme handler and prevents exploitation. [1]
Can you explain this vulnerability to me?
This vulnerability in the Yahoo! Shopping App for Android (versions prior to 14.15.0) is due to improper authorization in the handler for custom URL schemes. It allows a remote, unauthenticated attacker to trick a user into accessing arbitrary websites within the app, which can lead to phishing attacks. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by enabling attackers to lead you to malicious websites through the app, potentially causing you to fall victim to phishing attacks that may steal your personal information or credentials. [1]