Jiyu Kukan Toku-Toku coupon App for iOS versions 3.5.0 and earlier, and Jiyu Kukan Toku-Toku coupon App for Android versions 3.5.0 and earl…

published 2023-06-13 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-33068

cvss: 4.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits: 0; none known

Jiyu Kukan Toku-Toku coupon App for iOS versions 3.5.0 and earlier, and Jiyu Kukan Toku-Toku coupon App for Android versions 3.5.0 and earlier are vulnerable to improper server certificate verification. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 22 mo ago (2025-01-03)

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	4.8	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

RUNSYSTEM CO.,LTD. Jiyu Kukan Toku-Toku coupon App for iOS, and Jiyu Kukan Toku-Toku coupon App for Android

Classification

Weakness

CWE-295 Improper Certificate Validation

References

runsystem.co.jp /g1-pr/17570
vendor-advisory
apps.apple.com /jp/app/%E8%87%AA%E9%81%8A%E7%A9%BA%E9%96%93%E3%81%A8%E3%81%8F%E3%81%A8%E3%81%8F%E3%82%AF%E3%83%BC%E3%83%9D%E3
product
play.google.com /store/apps/details?id=jp.runsystem
product
jvn.jp /en/jp/JVN33836375/
third-party-advisory

Sources

CVE List CVE-2023-29501
NVD CVE-2023-29501

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary