PT-2023-30656 · Unknown · Com.Altamirano.Fabricio.Tvbrowser

Published 2023-12-27 · Updated 2024-01-09 · CVE-2023-47883

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions com.altamirano.fabricio.tvbrowser TV browser application versions through 4.5.1 for Android

Description The issue allows for JavaScript code execution via an explicit intent due to an exposed MainActivity. This could potentially lead to malicious code being executed on the device.

Recommendations For versions through 4.5.1, consider disabling the explicit intent functionality related to the exposed MainActivity as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-47883

Affected Products

Com.Altamirano.Fabricio.Tvbrowser

References · 9

• 🔥 https://github.com/actuator/com.altamirano.fabricio.tvbrowser/blob/main/CWE-94.md · Exploit
• 🔥 https://github.com/actuator/com.altamirano.fabricio.tvbrowser/blob/main/AFC-POC.apk · Exploit
• 🔥 https://github.com/actuator/com.altamirano.fabricio.tvbrowser/blob/main/TVBrowserDemo.gif · Exploit
• https://osv.dev/vulnerability/CVE-2023-47883 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47883 · Security Note
• https://twitter.com/Esparta6108713/status/1740146381250331027 · Twitter Post
• https://twitter.com/CVEnew/status/1740118914951201166 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1740154344488517736 · Twitter Post
• https://t.me/cvenotify/66817 · Telegram Post