CVE-2023-41898
Last modified
CVE-2023-41898 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Home-Assistant | Home Assistant Companion | < 2023.9.2 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-41898?
How severe is CVE-2023-41898?
How do I fix CVE-2023-41898?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-41892Craft CMS is a platform for creating digital experiences. Th…9.8
- CVE-2023-41893Home assistant is an open source home automation. The audit …5.4
- CVE-2023-41894Home assistant is an open source home automation. The assess…5.3
- CVE-2023-41895Home assistant is an open source home automation. The Home A…9.6
- CVE-2023-41896Home assistant is an open source home automation. Whilst aud…9
- CVE-2023-41897Home assistant is an open source home automation. Home Assis…9.6
- CVE-2023-41899Home assistant is an open source home automation. In affecte…7.2
- CVE-2023-4190Insufficient Session Expiration in GitHub repository admidio…6.5
- CVE-2023-41900Jetty is a Java based web server and servlet engine. Version…4.3
- CVE-2023-41901Rejected reason: Further research determined the issue is no…
- CVE-2023-41902An XPC misconfiguration vulnerability in CoreCode MacUpdater…7.8
- CVE-2023-41904Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypa…5.4
Are you affected by CVE-2023-41898?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST