by Kastro
Paper/Archive/CVE-2023-2507

CVE-2023-2507

CleverTap Cordova Plugin — CleverTap Cordova Plugin 2.6.2 - Reflected XSS

EPSS 0.9%public exploitCVSS 9.3
critical.is priorityof 100
50
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 58.4.584 × 2011.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.

Affected

ProductAffectedFixed inSource
Cordova Plugin2.6.2–CNA

Scores by source

Fluid Attacks (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

writeupfluidattacks.com/advisories/maidenrefgithub.com/CleverTap/clevertap-cordovapatchgithub.com/CleverTap/clevertap-cordova/releases/tag/2.7.0