Описание
CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker.
This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.
Ссылки
- ExploitThird Party Advisory
- Product
- ExploitThird Party Advisory
- Product
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:clevertap:clevertap:2.6.2:*:*:*:*:cordova:*:*
EPSS
Процентиль: 26%
0.00089
Низкий
9.3 Critical
CVSS3
6.1 Medium
CVSS3
Дефекты
CWE-79
CWE-79
Связанные уязвимости
CVSS3: 9.3
github
больше 2 лет назад
CleverTap Cordova plugin vulnerable to Cross-site Scripting
EPSS
Процентиль: 26%
0.00089
Низкий
9.3 Critical
CVSS3
6.1 Medium
CVSS3
Дефекты
CWE-79
CWE-79