CVE-2023-28686 Business logic in n/a
Attackers can modify bookmark stores and force group chat joins via crafted messages, potentially tricking victims into disclosing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-28686?
CVE-2023-28686 is a medium-severity vulnerability in Debian Debian Linux, published on 24 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.
Weakness: CWE-639
Which versions are affected by CVE-2023-28686?
It affects 3 products.
Linux distribution packages (1)
dino openSUSE:Tumbleweed | All versions | 0.4.2-1.1 |
Products include Debian Debian Linux, Dino Dino, Fedoraproject Fedora.
How do I fix CVE-2023-28686?
Upgrade to a fixed version.
Is CVE-2023-28686 being exploited?
There is no known exploitation of CVE-2023-28686 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2023-TR32698, DEBIAN-CVE-2023-28686, DSA-5379-1, GHSA-xxch-mf4j-qcvj, MGASA-2023-0122, UBUNTU-CVE-2023-28686 and 2 more.