PT-2013-5758 · Tapbots · Tweetbot

Guillaume Ross · Publicado 2013-11-12 · Atualizado 2013-11-13 · CVE-2013-5726

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tweetbot versions 1.3.3 for Mac, and 2.8.5 for iPad and iPhone

Description The issue allows remote attackers to automatically force the user to perform undesired actions, such as follow or favorite actions, without confirmation. This can be achieved via the "tweetbot:///follow/" URL.

Recommendations For Tweetbot version 1.3.3 on Mac, consider disabling the ability to perform follow or favorite actions via URLs until a patch is available. For Tweetbot version 2.8.5 on iPad and iPhone, restrict access to the tweetbot:///follow/ URL to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2013-5726

Produtos afetados

Tweetbot

Referências · 4

• 🔥 http://blog.binaryfactory.ca/2013/11/cve-2013-5726-tweetbot-for-ios-and-mac-user-disclosureprivacy-issue · Exploit
• 🔥 http://seclists.org/fulldisclosure/2013/Nov/9 · Exploit
• http://osvdb.org/99256 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5726 · Nota de Segurança