critical9.3
CVE-2023-2507
CleverTap Cordova plugin vulnerable to Cross-site Scripting
Impact
CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | clevertap-cordova | < 2.7.0 | 2.7.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Clevertap | Clevertap | Version 2.6.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://fluidattacks.com/advisories/maiden/
- https://github.com/CleverTap/clevertap-cordova
- https://github.com/CleverTap/clevertap-cordova/releases/tag/2.7.0
- https://github.com/advisories/GHSA-x2ph-qqwm-9cc6
- https://nvd.nist.gov/vuln/detail/CVE-2023-2507
- https://fluidattacks.com/advisories/maiden