Back

CVE-2024-33905

April 29, 2024, 12:42 p.m.

Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Telegram WebK

  • before 2.0.0 (488)

Source

cve@mitre.org

Tags

CVE-2024-33905 details

Published : April 29, 2024, 6:15 a.m.
Last Modified : April 29, 2024, 12:42 p.m.

Description

In Telegram WebK before 2.0.0 (488), a crafted Mini Web App allows XSS via the postMessage web_app_open_link event type.

CVSS Score

1 2 3 4 5 6 7 8 9 10

Weakness

Weakness Name Description

References

URL Source
https://github.com/morethanwords/tweb/commit/2153ea9878668769faac8dd5931b7e0b96a9f129/src/components/popups/webApp.ts cve@mitre.org
https://medium.com/%40pedbap/telegram-web-app-xss-session-hijacking-1-click-95acccdc8d90 cve@mitre.org
https://www.openwall.com/lists/oss-security/2024/04/28/4 cve@mitre.org
This website uses the NVD API, but is not approved or certified by it.