Описание
Xamarin.Forms Spoofing Vulnerability
A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerability could allow an attacker to execute arbitrary Javascript code on a target system.
For the attack to be successful, the targeted user would need to browse to a malicious website or a website serving the malicious code through Xamarin.Forms.
The security update addresses this vulnerability by preventing the malicious Javascript from running in the WebView.
Меры по смягчению последствий
Customers using older versions of Xamarin.Forms who are unable to update at this time can enable the setting themselves with this renderer:
Customers who are not vulnerable and wish to revert this behavior can use the same renderer with the false value instead.
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
Older Software Release
DOS
EPSS
4.7 Medium
CVSS3
Связанные уязвимости
<p>A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerability could allow an attacker to execute arbitrary Javascript code on a target system.</p> <p>For the attack to be successful, the targeted user would need to browse to a malicious website or a website serving the malicious code through Xamarin.Forms.</p> <p>The security update addresses this vulnerability by preventing the malicious Javascript from running in the WebView.</p>
A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106, aka 'Xamarin.Forms Spoofing Vulnerability'.
Уязвимость платформы пользовательского интерфейса Microsoft Xamarin.Forms, компонента для отображения веб-страниц WebView и браузера Google Chrome, связанная с ошибками представления информации пользовательским интерфейсом, позволяющая нарушителю проводить спуфинг-атаки
EPSS
4.7 Medium
CVSS3