CVE-2013-5118
Description
Cross-site scripting (XSS) vulnerability in the Good for Enterprise app before 2.2.4.1659 for iOS allows remote attackers to inject arbitrary web script or HTML via an HTML e-mail message.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Good for Enterprise 2.2.2.1611 - Cross-Site Scripting
The vulnerable versions are v2.2.2.1611 and earlier
Proof of Concept:
HTML Email including the following payload will execute Javascript statements when the victim open the email using the vulnerable version.
Payload:
<body>
<div>
<script>alert('XSS Here')</script>
</div>
</body>
Remediation:
I worked with the Good people to close the issue, I provided some guidance and feedback and agreed with them to not disclose it until they fix it.
The new release is now available:
Update the "Good for Enterprise" iOS application to 2.2.4.1659 or newer
References:
https://www.roblest.com/#research:CVE-2013-5118
Can the comunity please provide feedback and comments in order to ensure the fix is working well
Many thanks
MarioApplication impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| good | good_for_enterprise | {"endIncluding":"2.2.3"} | |
| good | good_for_enterprise | 1.9.8 | |
| good | good_for_enterprise | 1.9.9 | |
| good | good_for_enterprise | 1.9.10 | |
| good | good_for_enterprise | 2.0.0 | |
| good | good_for_enterprise | 2.0.1 | |
| good | good_for_enterprise | 2.0.2 | |
| good | good_for_enterprise | 2.0.3.1464 | |
| good | good_for_enterprise | 2.1.2.1510 | |
| good | good_for_enterprise | 2.1.3.1513 | |
| good | good_for_enterprise | 2.1.4.1518 | |
| good | good_for_enterprise | 2.1.5.1551 | |
| good | good_for_enterprise | 2.2.0.1575 | |
| good | good_for_enterprise | 2.2.1.1591 | |
| good | good_for_enterprise | 2.2.2 | |
References
CWEs
CWE-79
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.