CVE-2013-5726 | BDVDB-2026-58374 Detail

Description#

Tweetbot 1.3.3 for Mac, and 2.8.5 for iPad and iPhone, does not require confirmation of (1) follow or (2) favorite actions, which allows remote attackers to automatically force the user to perform undesired actions, as demonstrated via the tweetbot:///follow/ URL.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://seclists.org/fulldisclosure/2013/Nov/9
http://blog.binaryfactory.ca/2013/11/cve-2013-5726-tweetbot-for-ios-and-mac-user-disclosureprivacy-issue/
http://osvdb.org/99256

Exploit#

No public exploit known

History#

Version 12013-11-12Record published in the CVE List.
Version 22024-09-17Most recent update recorded in the CVE List.