{"id":"CVE-2024-38480","aliases":["EUVD-2024-37360","GHSA-jc4p-8qhr-mrv4"],"status":"published","title":"\"Piccoma\" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an...","description":"\"Piccoma\" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the API key. Note that the users of the app are not directly affected by this vulnerability.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00169,"percentile":0.06299,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-798"],"published":"2024-07-01T02:27:01Z","modified":"2026-06-17T07:40:22Z","products":[{"vendor":"kakao piccoma corp.","product":"\"piccoma\" app for android"},{"vendor":"kakao piccoma corp.","product":"\"piccoma\" app for ios"}],"references":[{"url":"https://play.google.com/store/apps/details?id=jp.kakao.piccoma","tags":["x_transferred"]},{"url":"https://apps.apple.com/jp/app/%E3%83%94%E3%83%83%E3%82%B3%E3%83%9E/id1091496983","tags":["x_transferred"]},{"url":"https://jvn.jp/en/jp/JVN01073312/","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38480"},{"url":"https://jvn.jp/en/jp/JVN01073312"},{"url":"https://github.com/advisories/GHSA-jc4p-8qhr-mrv4"}],"sources":{"cve":[{"id":"CVE-2024-38480","description":"\"Piccoma\" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the API key. Note that the users of the app are not directly affected by this vulnerability.","status":"published","published":"2024-07-01T02:27:01.945Z","modified":"2024-11-12T17:15:57.289Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:34:16.367792Z"}],"euvd":[{"id":"EUVD-2024-37360","description":"\"Piccoma\" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the API key. Note that the users of the app are not directly affected by this vulnerability.","status":"published","published":"2024-07-01T02:27:01Z","modified":"2024-11-12T17:15:57Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:05:03.88189Z"}],"ghsa":[{"id":"GHSA-jc4p-8qhr-mrv4","title":"\"Piccoma\" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an...","description":"\"Piccoma\" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the API key. Note that the users of the app are not directly affected by this vulnerability.","status":"published","published":"2024-07-01T06:31:17Z","modified":"2024-11-12T21:31:53Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:58:48.700326Z"}],"nvd":[{"id":"CVE-2024-38480","description":"\"Piccoma\" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the API key. Note that the users of the app are not directly affected by this vulnerability.","status":"published","published":"2024-07-01T05:15:04.613Z","modified":"2026-06-17T07:40:22.02Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:10:09.388795Z"}]}}