Description (CNA)
The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://gubello.me
- https://sparkmailapp.com/
- https://www.gubello.me/blog/javascript-injection-in-six-android-mail-clients/
ADP enrichment
No English description supplied.