CVE-2024-42041 - OpenCVE

The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 for Android allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Apptool-browser-video	Video Downloader

No data.

No data.

References

Link	Providers
https://github.com/actuator/com.videodownload.browser.videodownloader/blob/main/CVE-2024-42041

History

Thu, 31 Oct 2024 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apptool-browser-video Apptool-browser-video video Downloader
Weaknesses		CWE-94
CPEs		cpe:2.3:a:apptool-browser-video:video_downloader::::::::
Vendors & Products		Apptool-browser-video Apptool-browser-video video Downloader
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 30 Oct 2024 18:15:00 +0000

Type	Values Removed	Values Added
Description		The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 for Android allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component.
References		https://github.com/actuator/com.videodownload.browser.videodownloader/blob/main/CVE-2024-42041

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-10-30T00:00:00

Updated: 2024-10-31T14:40:57.013Z

Reserved: 2024-07-27T00:00:00

Link: CVE-2024-42041

Vulnrichment

Updated: 2024-10-31T14:36:15.429Z

NVD

Status : Received

Published: 2024-10-30T18:15:07.223

Modified: 2024-10-31T15:35:35.840

Link: CVE-2024-42041

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-42041", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-10-31T14:40:57.013Z", "dateReserved": "2024-07-27T00:00:00", "datePublished": "2024-10-30T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-10-30T18:06:04.049078"}, "descriptions": [{"lang": "en", "value": "The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 for Android allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/actuator/com.videodownload.browser.videodownloader/blob/main/CVE-2024-42041"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "affected": [{"vendor": "apptool-browser-video", "product": "video_downloader", "cpes": ["cpe:2.3:a:apptool-browser-video:video_downloader:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "20-30.05.24", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-31T14:35:52.452400Z", "id": "CVE-2024-42041", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-31T14:40:57.013Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-42041", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-31T14:35:52.452400Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apptool-browser-video:video_downloader:*:*:*:*:*:*:*:*"], "vendor": "apptool-browser-video", "product": "video_downloader", "versions": [{"status": "affected", "version": "20-30.05.24"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-31T14:36:15.429Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/actuator/com.videodownload.browser.videodownloader/blob/main/CVE-2024-42041"}], "descriptions": [{"lang": "en", "value": "The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 for Android allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-10-30T18:06:04.049078"}}}, "cveMetadata": {"cveId": "CVE-2024-42041", "state": "PUBLISHED", "dateUpdated": "2024-10-31T14:40:57.013Z", "dateReserved": "2024-07-27T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-10-30T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}