Description (CNA)
CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| CleverTap / Cordova Plugin | affected 2.6.2 |
CWE
CWE-79
References
- https://fluidattacks.com/advisories/maiden/
- https://github.com/CleverTap/clevertap-cordova
- https://github.com/CleverTap/clevertap-cordova/releases/tag/2.7.0
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.