CVEvulnerability

CVE-2013-5726

6.8 MEDIUM Published 2013-11-12 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-11-12
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-352

Description

Tweetbot 1.3.3 for Mac, and 2.8.5 for iPad and iPhone, does not require confirmation of (1) follow or (2) favorite actions, which allows remote attackers to automatically force the user to perform undesired actions, as demonstrated via the tweetbot:///follow/ URL.

Affected configurations

• tapbots tweetbot 1.3.3 • tapbots tweetbot 2.8.5

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

Referenced by CWE · observed example (1)

  • CWE-939 Improper Authorization in Handler for Custom URL Scheme weakness

References