CVE-2019-16681

The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to the opening of arbitrary URLs, which can inject deceptive content into the UI. (When in physical possession of the device, opening local files is also possible.) NOTE: As of 2019-09-23, the vendor has not agreed that this issue has serious impact. The vendor states that the issue is not critical because it does not allow Elevation of Privilege, Sensitive Data Leakage, or any critical unauthorized activity from a malicious user. The vendor also states that a victim must first install a malicious APK to their application.

CVSS v3 4.7 MEDIUM
CVSS v2.0 2.6 LOW

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/tarantula-team/Traveloka-Android-App-Critical-Vulnerability	Broken Link
https://web.archive.org/web/20190923165849/https://github.com/tarantula-team/Traveloka-Android-App-Critical-Vulnerability	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:traveloka:traveloka:3.14.0:*:*:*:*:android:*:*

History

No history.

Information

Published : 2019-09-21 21:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-16681

Mitre link : CVE-2019-16681

CVE.ORG link : CVE-2019-16681

JSON object : View

Products Affected

traveloka

traveloka

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2019-16681", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.6}]}, "published": "2019-09-21T21:15:10.733", "references": [{"url": "https://github.com/tarantula-team/Traveloka-Android-App-Critical-Vulnerability", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://web.archive.org/web/20190923165849/https://github.com/tarantula-team/Traveloka-Android-App-Critical-Vulnerability", "tags": ["Third Party Advisory"], "source": "nvd@nist.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to the opening of arbitrary URLs, which can inject deceptive content into the UI. (When in physical possession of the device, opening local files is also possible.) NOTE: As of 2019-09-23, the vendor has not agreed that this issue has serious impact. The vendor states that the issue is not critical because it does not allow Elevation of Privilege, Sensitive Data Leakage, or any critical unauthorized activity from a malicious user. The vendor also states that a victim must first install a malicious APK to their application."}, {"lang": "es", "value": "La aplicaci\u00f3n Traveloka versi\u00f3n 3.14.0 para Android exporta com.traveloka.android.activity.common.WebViewActivity, lo que conlleva a la apertura de URL arbitrarias, que pueden inyectar contenido enga\u00f1oso en la interfaz de usuario. (Cuando est\u00e9 en posesi\u00f3n f\u00edsica del dispositivo, tambi\u00e9n es posible abrir archivos locales). NOTA: A partir del 23/09/2019, el proveedor no ha acordado que este problema tenga un impacto grave. El proveedor declara que el problema no es cr\u00edtico porque no permite la Elevaci\u00f3n de privilegios, la Fugas de datos confidenciales o cualquier actividad cr\u00edtica no autorizada de un usuario malintencionado. El proveedor tambi\u00e9n afirma que una v\u00edctima primero debe instalar un APK malicioso en su aplicaci\u00f3n."}], "lastModified": "2019-09-24T18:15:10.937", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:traveloka:traveloka:3.14.0:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "0DE515D2-5010-40C8-AF57-7E4D76FBB268"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}