CVEvulnerability
CVE-2022-28799
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-06-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-425
Description
The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL (unvalidated deeplink) can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click.
Affected configurations
• tiktok tiktok (< 23.7.3)
Related
Weakness · CWE (1)
- CWE-425 Direct Request weakness
References
- https://github.com/Ch0pin/security-advisories/security/advisories/GHSA-v39p-88q5-5cvr Third Party Advisory
- https://hackerone.com/reports/1500614 Issue Tracking, Third Party Advisory
- https://support.tiktok.com/en/safety-hc/reporting-security-vulnerabilities/reporting-the-security-vulnerabilities Third Party Advisory
- https://github.com/Ch0pin/security-advisories/security/advisories/GHSA-v39p-88q5-5cvr Third Party Advisory
- https://hackerone.com/reports/1500614 Issue Tracking, Third Party Advisory
- https://support.tiktok.com/en/safety-hc/reporting-security-vulnerabilities/reporting-the-security-vulnerabilities Third Party Advisory