CVE-2022-41797
About
Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5 and Lemon8 App for iOS versions prior to 3.3.5 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
Rainforest analyst review
The Lemon8 mobile app mishandles authorization in its custom URL scheme handler, so a crafted link can make the app navigate the user to an arbitrary website. In practice that means an attacker can drive a Lemon8 user to a page of their choosing, setting up a convincing phishing lure that appears to come from within a trusted app. It requires the user to follow the malicious link, and the impact is limited to confidentiality and integrity at a low level.
This is a client-side, social-engineering-enabling issue, not a server compromise. The realistic harm is a phishing hop, and it depends on delivering the link and the user acting on it, so there is no mass-exploitation dynamic and nothing here that touches backend infrastructure. It matters to the app's end users far more than to anyone defending servers or networks.
For our purposes this ranks low and mostly sits outside the infrastructure threat model, its remediation is the app update to 3.3.5 or later on users' devices. Where we have any say, the lever is mobile-fleet update enforcement rather than anything on the server side; there is little for us to virtually patch or monitor centrally.
References
Related CVEs
Frequently asked questions
What is CVE-2022-41797?
Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5 and Lemon8 App for iOS versions prior to 3.3.5 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
How severe is CVE-2022-41797?
CVE-2022-41797 carries a CVSS 3.1 base score of 6.5, rated medium. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 64 out of 100, in the elevated band.
How is CVE-2022-41797 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): attack vector Network, attack complexity Low, privileges required None, user interaction Required. Impact on confidentiality High, integrity None and availability None.
Which products are affected by CVE-2022-41797?
Public advisories list the following as affected: lemon8. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2022-41797?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.