CVE-2022-41797

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-24 · updated 2026-06-17
Weakness: CWE-862

Description

Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5 and Lemon8 App for iOS versions prior to 3.3.5 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.

Affected products

ByteDance K.K. Lemon8 App for Android and Lemon8 App for iOS: before 3.3.5 — fixed in 3.3.5

How to fix

Upgrade to a fixed version: ByteDance K.K. Lemon8 App for Android and Lemon8 App for iOS 3.3.5. Check the vendor advisory for mitigations.

References

https://apps.apple.com/jp/app/lemon8/id1498607143
https://jvn.jp/en/jp/JVN10921428/index.html
https://play.google.com/store/apps/details?id=com.bd.nproject&hl=ja&gl=US
https://apps.apple.com/jp/app/lemon8/id1498607143
https://jvn.jp/en/jp/JVN10921428/index.html
https://play.google.com/store/apps/details?id=com.bd.nproject&hl=ja&gl=US

Get alerted when CVE-2022-41797 or the next vulnerability affects your stack