Description (CNA)
The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://gubello.me
- http://release-notes.9folders.com/
- https://www.gubello.me/blog/javascript-injection-in-six-android-mail-clients/
ADP enrichment
No English description supplied.