Cross-App Scripting vulnerability in a Swiss emergency mobile app allowed an attacker to load arbitrary URLs inside the android app via an exported activity
Other
NTCF:
NTCF-2024-58172
Product:
Classified
Vendor:
Classified
Criticality:
low
Status:
fixed
Discovered:
2024-04-05
Detail:
Classified
Description
In accordance with the NTC Vulnerability Disclosure Policy, the details of this vulnerability will not be publicly disclosed.
Neither the product and vendor name nor a detailed description of the vulnerability will be publicly released if all of the following conditions are met:
- the vendor fixes the vulnerability without requiring any action by the affected parties (e.g. a cloud service where the user is not required to install patches)
- there is no indication that the vulnerability has been exploited (e.g. in the log files)
Further details may be provided on request. Please use the contact form.
Timeline
2024-04-05: initial discovery
2024-04-09: first contact to vendor
2024-04-10: private disclosure to vendor
2024-07-05: granted vendor's request to extend grace period for publication
2024-07-17: fix by vendor
2024-07-23: public disclosure