CVE-2019-14759: XSS
An issue was discovered in KaiOS 1.0, 2.5, and 2.5.1. The pre-installed Radio application is vulnerable to HTML and JavaScript injection attacks. A local attacker can inject arbitrary HTML into the Radio application. At a bare minimum, this allows an attacker to take control over the Radio application's UI (e.g., display a malicious prompt to the user asking them to re-enter credentials such as their KaiOS credentials to continue using the application) and also allows an attacker to abuse any of the privileges available to the mobile application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-14759?
CVE-2019-14759 is classified as a high severity vulnerability due to its potential for local exploitation and arbitrary HTML injection.
How do I fix CVE-2019-14759?
To fix CVE-2019-14759, it is recommended to update to the latest version of KaiOS that addresses this vulnerability.
What types of attacks can be executed due to CVE-2019-14759?
Due to CVE-2019-14759, local attackers can perform HTML and JavaScript injection attacks on the vulnerable Radio application.
Which versions of KaiOS are affected by CVE-2019-14759?
CVE-2019-14759 affects KaiOS versions 1.0, 2.5, and 2.5.1.
Can remote attackers exploit CVE-2019-14759?
No, CVE-2019-14759 requires local access to exploit, making it less likely for remote attackers to take advantage of this vulnerability.