CVE-2023-42471

Publicada em 11 set 2023 · Atualizada em 26 set 2024

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 2.8%

The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. It contains a manifest entry that exports the wave.ai.browser.ui.splash.SplashScreen activity. This activity uses a WebView component to display web content and doesn't adequately validate or sanitize the URI or any extra data passed in the intent by a third party application (with no permissions).

Produtos afetados

n/a · n/a

Referências

https://github.com/actuator/cve/blob/main/CVE-2023-42471 https://github.com/actuator/wave.ai.browser/blob/main/CWE-94.md https://github.com/actuator/wave.ai.browser/blob/main/poc.apk