CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker.
This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.
References
| Link | Resource |
|---|---|
| https://fluidattacks.com/advisories/maiden/ | Exploit Third Party Advisory |
| https://github.com/CleverTap/clevertap-cordova | Product |
| https://github.com/CleverTap/clevertap-cordova/releases/tag/2.7.0 | |
| https://fluidattacks.com/advisories/maiden/ | Exploit Third Party Advisory |
| https://github.com/CleverTap/clevertap-cordova | Product |
Configurations
History
24 Sep 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | (en) CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them. |
21 Nov 2024, 07:58
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.3 |
| References | () https://fluidattacks.com/advisories/maiden/ - Exploit, Third Party Advisory | |
| References | () https://github.com/CleverTap/clevertap-cordova - Product |
Information
Published : 2023-07-15 19:15
Updated : 2025-09-24 14:15
NVD link : CVE-2023-2507
Mitre link : CVE-2023-2507
CVE.ORG link : CVE-2023-2507
JSON object : View
Products Affected
clevertap
- clevertap
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')