CVE-2022-28799: High severity tiktok vulnerability
Published May 30, 2022
·Updated
The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL (unvalidated deeplink) can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click.
Affected Software
1 affected component
TikTok Tiktok Android<23.7.3
Event History
May 30, 2022
CVE Published
via MITRE·01:46 PM
Data Sourced
via MITRE·01:46 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2022-28799?
CVE-2022-28799 is considered a high severity vulnerability due to the potential for account takeover.
2
How do I fix CVE-2022-28799?
To fix CVE-2022-28799, users should update the TikTok application to version 23.7.3 or later.
3
What version of TikTok is affected by CVE-2022-28799?
CVE-2022-28799 affects all TikTok versions prior to 23.7.3.
4
What type of vulnerability is CVE-2022-28799?
CVE-2022-28799 is a vulnerability that allows for account takeover via unvalidated deeplink exploitation.
5
Can CVE-2022-28799 be exploited remotely?
Yes, CVE-2022-28799 can be exploited remotely by using a crafted URL.