CVE-2013-5726 in Tapbots Tweetbot
Summary
Tweetbot 1.3.3 for Mac, and 2.8.5 for iPad and iPhone, does not require confirmation of (1) follow or (2) favorite actions, which allows remote attackers to automatically force the user to perform undesired actions, as demonstrated via the tweetbot:///follow/ URL.
Reservation
09/11/2013
Disclosure
11/12/2013
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 11070 | Tapbots Tweetbot Authentication cross-site request forgery | 352 | Proof-of-Concept | Unavailable | CVE-2013-5726 |