CVE-2023-42471
The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.02%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. It contains a manifest entry that exports the wave.ai.browser.ui.splash.SplashScreen activity. This activity uses a WebView component to display web content and doesn't adequately validate or sanitize the URI or any extra data passed in the intent by a third party application (with no permissions).
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.02% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- wave-ai/wave
- Source
- cve@mitre.org
References
- https://github.com/actuator/cve/blob/main/CVE-2023-42471Third Party Advisory
- https://github.com/actuator/wave.ai.browser/blob/main/CWE-94.mdExploit
- https://github.com/actuator/wave.ai.browser/blob/main/poc.apkExploit
- https://github.com/actuator/cve/blob/main/CVE-2023-42471Third Party Advisory
- https://github.com/actuator/wave.ai.browser/blob/main/CWE-94.mdExploit
- https://github.com/actuator/wave.ai.browser/blob/main/poc.apkExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.