PT-2024-15684 · Facebook · Focus For Ios

James Lee · Published 2024-01-22 · Updated 2024-01-30 · CVE-2024-0606

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Focus for iOS versions prior to 122

Description The issue allows an attacker to execute unauthorized scripts on a legitimate site through UXSS (Universal Cross-Site Scripting) by using the window.open() function to open a JavaScript URI. This leads to unauthorized actions within the user's loaded webpage.

Recommendations For Focus for iOS versions prior to 122, update to version 122 or later to resolve the issue. As a temporary workaround, consider restricting the use of the window.open() function with JavaScript URIs to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-0606

Affected Products

Focus For Ios

References · 5

• https://osv.dev/vulnerability/CVE-2024-0606 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2024-03 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0606 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1855030 · Note
• https://twitter.com/CVEnew/status/1749502072414781784 · Twitter Post