CVE-2019-12366 The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission.
MediumCVSS 6.1
EPSS 0.99%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 9folders nine | <= 4.5.3a | No fix listed |
References
- release-notes.9folders.com release-notes vendor-advisory
- gubello.me third-party-advisory
- www.gubello.me exploit third-party-advisory