What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-1384.

Which devices are affected by this vulnerability?

This vulnerability affects Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5 and Insignia TV with FireOS versions prior to 7.6.3.3.

What is the severity of CVE-2023-1384?

The severity of CVE-2023-1384 is medium with a severity value of 6.1.

How can I fix this vulnerability?

To fix this vulnerability, update your Amazon Fire TV Stick 3rd gen to version 6.2.9.5 or later, and update your Insignia TV with FireOS to version 7.6.3.3 or later.

Vulnerability/
CVE-2023-1384

medium

6.1

CWE

80 79

3/5/2023

2/8/2024

CVE-2023-1384: XSS

Q: What is the title of the vulnerability?

The title of the vulnerability is 'The setMediaSource function on the amzn.thin.pl service does not sanitize the source parameter allowing for arbitrary javascript code to be run'.

First published: Wed May 03 2023(Updated: )

The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3.

Credit: cve-requests@bitdefender.com

Affected Software	Affected Version	How to fix
Amazon Fire OS	<6.2.9.5
Amazon Fire TV Stick 3rd gen
Amazon Fire OS	<7.6.3.3
Bestbuy Insignia Tv

Remedy

An automatic firmware update to the following versions fixes the issue: Amazon Fire TV Stick 3rd gen version 6.2.9.5 Insignia TV with FireOS version 7.6.3.3

Never miss a vulnerability like this again

Reference Links

https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/

Frequently Asked Questions

What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-1384.
What is the title of the vulnerability?
The title of the vulnerability is 'The setMediaSource function on the amzn.thin.pl service does not sanitize the source parameter allowing for arbitrary javascript code to be run'.
Which devices are affected by this vulnerability?
This vulnerability affects Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5 and Insignia TV with FireOS versions prior to 7.6.3.3.
What is the severity of CVE-2023-1384?
The severity of CVE-2023-1384 is medium with a severity value of 6.1.
How can I fix this vulnerability?
To fix this vulnerability, update your Amazon Fire TV Stick 3rd gen to version 6.2.9.5 or later, and update your Insignia TV with FireOS to version 7.6.3.3 or later.

collector/nvd-latest
collector/nvd-index
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/remedy
agent/author
agent/weakness
agent/severity
agent/last-modified-date
agent/references
agent/description
agent/tags
agent/first-publish-date
agent/event
vendor/amazon
canonical/amazon fire os
canonical/amazon fire tv stick 3rd gen
vendor/bestbuy
canonical/bestbuy insignia tv

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.