CVE-2023-6542 (published 2023-12-12T01:36:22.773Z)
Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application. On successful attack, an attacker could navigate to arbitrary URL including application deep links on the device.


Affected products: Vendor: SAP_SE
Product: SAP EMARSYS SDK ANDROID
Versions: 100