CVE-2019-13097
Last modified
CVE-2019-13097 is a vulnerability of currently unknown severity. The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. Attackers can manipulate users' score parameters exchanged between client and server.. EPSS estimates a 1.37% chance of exploitation in the next 30 days.
Description
The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. Attackers can manipulate users' score parameters exchanged between client and server.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Cat Runner\ | Decorate Home Project | cat_runner\ | Decorate Home |
References
- https://pastebin.com/WkkGk0twExploit, Third Party Advisory
- https://www.youtube.com/watch?v=u5iEeLZnYVgExploit, Third Party Advisory
- https://pastebin.com/WkkGk0twExploit, Third Party Advisory
- https://www.youtube.com/watch?v=u5iEeLZnYVgExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-13097?
How severe is CVE-2019-13097?
How do I fix CVE-2019-13097?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-13083XnView Classic 2.48 has a User Mode Write AV starting at xnv…
- CVE-2019-13084XnView Classic 2.48 has a User Mode Write AV starting at xnv…
- CVE-2019-13085XnView Classic 2.48 has a User Mode Write AV starting at xnv…
- CVE-2019-13086core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has …
- CVE-2019-1309A denial of service vulnerability exists when Microsoft Hype…6.8
- CVE-2019-13096TronLink Wallet 2.2.0 stores user wallet keystore in plainte…
- CVE-2019-13098The user password via the registration form of TronLink Wall…
- CVE-2019-13099The Momo application 2.1.9 for Android stores confidential i…
- CVE-2019-1310A denial of service vulnerability exists when Microsoft Hype…6.8
- CVE-2019-13100The Send Anywhere application 9.4.18 for Android stores conf…
- CVE-2019-13101An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04,…9.8
- CVE-2019-13103A crafted self-referential DOS partition table will cause al…7.1
Are you affected by CVE-2019-13097?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST