PT-2023-16946 · Insignia+1 · Insignia Tv With Fireos+1

CVE-2023-1384 · Publicado 2023-05-03 · Atualizado 2023-05-12

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5 Insignia TV with FireOS versions prior to 7.6.3.3

Description The issue is related to the setMediaSource function on the amzn.thin.pl service, which does not properly sanitize the source parameter. This allows for arbitrary JavaScript code to be executed.

Recommendations For Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5, update to version 6.2.9.5 or later. For Insignia TV with FireOS versions prior to 7.6.3.3, update to version 7.6.3.3 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-80

CWE-79

Identificadores relacionados

CVE-2023-1384

Produtos afetados

Amazon Fire Tv Stick

Insignia Tv With Fireos

Referências · 4

• https://t.me/cibsecurity/63228 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-1384 · Aviso do Fabricante
• https://bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-1384 · Nota de Segurança