CVE-2023-41898CWE-345CWE-94

Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android

High · published October 19, 2023

CVSS v3.1
8.6
EPSS
0%
Percentile
7.0
In the wild
Unconfirmed
What it is

Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00178 · 7.0th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2023-10-19T22:08Z
EPSS history
Timeline
  • 19 OCT 22:08Z
    Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android
    cvelistv5