CVE-2023-43955

Опубликовано: 27 дек. 2023

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData.

Ссылки

https://github.com/actuator/com.phlox.tvwebbrowser
Exploit
Third Party Advisory
https://github.com/actuator/com.phlox.tvwebbrowser/blob/main/CWE-94.md
Exploit
Third Party Advisory
https://github.com/actuator/com.phlox.tvwebbrowser/blob/main/poc.apk
Exploit
Third Party Advisory
https://github.com/truefedex/tv-bro/pull/182#issue-1901769895
Issue Tracking
https://github.com/actuator/com.phlox.tvwebbrowser
Exploit
Third Party Advisory
https://github.com/actuator/com.phlox.tvwebbrowser/blob/main/CWE-94.md
Exploit
Third Party Advisory
https://github.com/actuator/com.phlox.tvwebbrowser/blob/main/poc.apk
Exploit
Third Party Advisory
https://github.com/truefedex/tv-bro/pull/182#issue-1901769895
Issue Tracking

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:fedirtsapana:tv_bro:*:*:*:*:*:android:*:*

Версия до 2.0.0 (включая)

EPSS

Процентиль: 68%

0.00574

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-94

Связанные уязвимости

GHSA-cp9q-6fwr-c66g