CVE-2017-16905 The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, and consequently achieve remote code execution, via a man-in-...
HighCVSS 8.1
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, and consequently achieve remote code execution, via a man-in-the-middle attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| duolingo tinycards | < 1.0 | 1.0 |
References
- hackerone.com exploit third-party-advisory
- wwws.nightwatchcybersecurity.com third-party-advisory