CVE-2014-8869 Multiple cross-site scripting (XSS) vulnerabilities in mobiquo/smartbanner/welcome.php in the Tapatalk (com.tapatalk.wbb4) plugin 1.x before 1.1.2 for Woltlab Burning Board 4.0 allow remote attackers....
MediumCVSS 4.3
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in mobiquo/smartbanner/welcome.php in the Tapatalk (com.tapatalk.wbb4) plugin 1.x before 1.1.2 for Woltlab Burning Board 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) app_android_id or (2) app_kindle_url parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tapatalk | = 1.0.0 | No fix listed |
| tapatalk | = 1.0.1 | No fix listed |
| tapatalk | = 1.0.2 | No fix listed |
| tapatalk | = 1.1.0 | No fix listed |
| tapatalk | = 1.1.1 | No fix listed |
References
- 20150112 [RT-SA-2014-015] Cross-site Scripting in Tapatalk Plugin for WoltLab Burning Board 4.0 exploit mailing-list
- 20150112 [RT-SA-2014-015] Cross-site Scripting in Tapatalk Plugin for WoltLab Burning Board 4.0 mailing-list
- 71997 exploit vdb-entry
- support.tapatalk.com patch vendor-advisory
- www.redteam-pentesting.de exploit