CVE-2024-45240: High severity tiktok vulnerability
The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deeplink traversal (in the application's exposed WebView). (On Android 12 and later, this is only exploitable by third-party applications.)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45240?
The severity of CVE-2024-45240 is categorized as medium due to potential unauthorized access via JavaScript interfaces.
How do I fix CVE-2024-45240?
To fix CVE-2024-45240, update the TikTok application to version 34.5.5 or later, which addresses this vulnerability.
What types of devices are affected by CVE-2024-45240?
CVE-2024-45240 affects Android devices running TikTok version prior to 34.5.5, particularly impacting those on versions before Android 12.
Can CVE-2024-45240 be exploited on Android 12 and later?
Yes, CVE-2024-45240 can be exploited on Android 12 and later, but only by third-party applications.
What is the vector for exploitation of CVE-2024-45240?
CVE-2024-45240 can be exploited via deeplink traversal to take over Lynxview JavaScript interfaces in the TikTok application's WebView.