Vulnerability Details : CVE-2023-41898
Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`.
Products affected by CVE-2023-41898
- cpe:2.3:a:home-assistant:home_assistant_companion:*:*:*:*:*:android:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-41898
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 23 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-41898
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | |
|
8.6
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
1.8
|
6.0
|
GitHub, Inc. |
CWE ids for CVE-2023-41898
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)
-
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.Assigned by: security-advisories@github.com (Secondary)
References for CVE-2023-41898
-
https://github.com/home-assistant/core/security/advisories/GHSA-jvpm-q3hq-86rg
Arbitrary URL load in Android WebView in `MyActivity.kt` · Advisory · home-assistant/core · GitHubVendor Advisory
Jump to