Good for Enterprise iOS application versions 2.2.2.1611 and below suffer from a cross site scripting vulnerability.
9824e01c248eb8f060865f76eace7ae4777a6461f7136f0972ad8ea4dc0eb4c3Hello,
Last month I identified a XSS vulnerability in the Good for Enterprise iOS application.
The vulnerable versions are v2.2.2.1611 and earlier
Proof of Concept:
HTML Email including the following payload will execute Javascript statements when the victim open the email using the vulnerable version.
Payload:
<body>
<div>
<script>alert('XSS Here')</script>
</div>
</body>
Remediation:
I worked with the Good people to close the issue, I provided some guidance and feedback and agreed with them to not disclose it until they fix it.
The new release is now available:
Update the "Good for Enterprise" iOS application to 2.2.4.1659 or newer
References:
https://www.roblest.com/#research:CVE-2013-5118
Can the comunity please provide feedback and comments in order to ensure the fix is working well
Many thanks
Mario
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed