CVE-2019-14759

An issue was discovered in KaiOS 1.0, 2.5, and 2.5.1. The pre-installed Radio application is vulnerable to HTML and JavaScript injection attacks. A local attacker can inject arbitrary HTML into the Radio application. At a bare minimum, this allows an attacker to take control over the Radio application's UI (e.g., display a malicious prompt to the user asking them to re-enter credentials such as their KaiOS credentials to continue using the application) and also allows an attacker to abuse any of the privileges available to the mobile application.

CVSS v3 4.4 MEDIUM
CVSS v2.0 1.9 LOW

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://www.nccgroup.trust/us/our-research/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:kaiostech:kaios:1.0:::::::*
	cpe:2.3:o:kaiostech:kaios:2.5:::::::*
	cpe:2.3:o:kaiostech:kaios:2.5.1:::::::*

History

No history.

Information

Published : 2020-09-14 20:15

Updated : 2024-02-28 17:47

NVD link : CVE-2019-14759

Mitre link : CVE-2019-14759

CVE.ORG link : CVE-2019-14759

JSON object : View

Products Affected

kaiostech

kaios

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2019-14759", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.8}]}, "published": "2020-09-14T20:15:10.580", "references": [{"url": "https://www.nccgroup.trust/us/our-research/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in KaiOS 1.0, 2.5, and 2.5.1. The pre-installed Radio application is vulnerable to HTML and JavaScript injection attacks. A local attacker can inject arbitrary HTML into the Radio application. At a bare minimum, this allows an attacker to take control over the Radio application's UI (e.g., display a malicious prompt to the user asking them to re-enter credentials such as their KaiOS credentials to continue using the application) and also allows an attacker to abuse any of the privileges available to the mobile application."}, {"lang": "es", "value": "Se detect\u00f3 un problema en KaiOS versiones 1.0, 2.5 y 2.5.1. La aplicaci\u00f3n Radio preinstalada es vulnerable a ataques de inyecci\u00f3n de HTML y JavaScript. Un atacante local puede inyectar HTML arbitrario en la aplicaci\u00f3n Radio. Como m\u00ednimo, esto permite a un atacante tomar el control de la Interfaz de Usuario de la aplicaci\u00f3n Radio (por ejemplo, mostrar un mensaje malicioso al usuario pidi\u00e9ndole que vuelva a ingresar sus credenciales, tal y como sus credenciales KaiOS, para continuar usando la aplicaci\u00f3n) y tambi\u00e9n permite a un atacante abusar de cualquiera de los privilegios disponibles para la aplicaci\u00f3n m\u00f3vil"}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:kaiostech:kaios:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0C6D27E-2B58-4455-B483-7F58EA821B56"}, {"criteria": "cpe:2.3:o:kaiostech:kaios:2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B68C183-6100-498C-BEB8-CC96A59C8213"}, {"criteria": "cpe:2.3:o:kaiostech:kaios:2.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "833E113E-0E23-41F7-94D2-3EF0495ED0B3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}