CVE-2013-5726 Cross-site request forgery in n/a
Remote attackers can force users to follow or favorite tweets via custom URL schemes without confirmation, requiring user interaction to trigger the action.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2013-5726?
CVE-2013-5726 is a medium-severity vulnerability in n/a, published on 12 Nov 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Tweetbot 1.3.3 for Mac, and 2.8.5 for iPad and iPhone, does not require confirmation of (1) follow or (2) favorite actions, which allows remote attackers to automatically force the user to perform undesired actions, as demonstrated via the tweetbot:///follow/ URL.
Weakness: CWE-352
Which versions are affected by CVE-2013-5726?
It affects 1 product.
Products include Tapbots Tweetbot.
How do I fix CVE-2013-5726?
No fix has been published for CVE-2013-5726 yet. Limit exposure of the affected software until one is available.
Is CVE-2013-5726 being exploited?
There is no known exploitation of CVE-2013-5726 in the wild and no public exploit code.
Sources
Also known as GHSA-phfm-7q7g-rf2x.