Vulnerability Description
The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, and consequently achieve remote code execution, via a man-in-the-middle attack.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Duolingo | Tinycards | < 1.0 |
| Android | - |
Related Weaknesses (CWE)
References
- https://hackerone.com/reports/281605ExploitThird Party Advisory
- https://wwws.nightwatchcybersecurity.com/2018/01/04/rce-in-duolingos-tinycards-aThird Party Advisory
- https://hackerone.com/reports/281605ExploitThird Party Advisory
- https://wwws.nightwatchcybersecurity.com/2018/01/04/rce-in-duolingos-tinycards-aThird Party Advisory
FAQ
What is CVE-2017-16905?
CVE-2017-16905 is a vulnerability with a CVSS score of 8.1 (HIGH). The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, and consequently achieve remote code execution, via a man-in-...
How severe is CVE-2017-16905?
CVE-2017-16905 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-16905?
Check the references section above for vendor advisories and patch information. Affected products include: Duolingo Tinycards, Google Android.