GHSA-x2ph-qqwm-9cc6

CleverTap Cordova plugin vulnerable to Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-2507

Packages

Ecosystem	Package	Affected	Fixed in
npm	clevertap-cordova	< 2.7.0	2.7.0

Details

As written in the advisory (Markdown source, shown as plain text).

CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-2507 advisory
https://fluidattacks.com/advisories/maiden web
https://github.com/CleverTap/clevertap-cordova package
https://github.com/CleverTap/clevertap-cordova/releases/tag/2.7.0 web