VULNERABILITY INTELLIGENCE

CVE-2019-9140

CVSS score8.1 HIGH
EPSS probability1.19%
CISA KEVNot currently listed
Published2019-08-01
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Description

When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a specific malicious URL.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')
  • CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

Primary references