CVE-2024-8039CWE-732

Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account takeover risks

Critical · published September 14, 2024

CVSS v3.1
9.8
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

🚨 A configuration mistake in BoomPlayer could let attackers stroll right into your account—no special skills required! 🔥 Think of it like leaving the front door of your house wide open while you’re out. Anyone passing by could just walk in and take whatever they like! This is absolutely devastating! An attacker could easily hijack accounts, gaining access to personal information, music playlists, and even payment details. Imagine the chaos that could ensue if someone took over your account and made changes without you knowing!

Put simply

Think of it like leaving the front door of your house wide open while you’re out. Anyone passing by could just walk in and take whatever they like! This vulnerability arises from improper permission settings in the BoomPlayer mobile application, allowing unauthorized users to gain access to user accounts without proper authentication.

What to do

This is absolutely devastating! An attacker could easily hijack accounts, gaining access to personal information, music playlists, and even payment details. Imagine the chaos that could ensue if someone took over your account and made changes without you knowing! To safeguard your accounts, immediately review and tighten the permission settings for the app. Update to the latest version as soon as it becomes available, and regularly check for updates to ensure you're running the most secure version. 🔐 You’ve got this! By addressing these settings, you’ll lock down your app and keep your data safe. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00434 · 36.6th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2024-09-14T03:28Z
EPSS history
Timeline
  • 14 SEP 03:28Z
    Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account takeover risks
    cvelistv5