The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
MediumVulnerability
CVE-2019-14760: An issue was discovered in KaiOS 2.5. The pre-installed Recorder application is vulnerable to HTML and JavaScript…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2019-14760
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
CVE-2019-14760 affects the pre-installed Recorder application in KaiOS 2.5. A local attacker can inject arbitrary HTML and JavaScript into it. At a minimum, this lets the attacker take over the Recorder UI, such as showing a fake prompt that asks the user to re-enter KaiOS credentials, and abuse any privileges available to the application.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.