CVE-2023-2507

CleverTap Cordova Plugin 2.6.2 - Reflected XSS

State: Published
Severity: 9.3 Critical
Published: Jul 15, 2023
Updated: Sep 24, 2025
Reserved: May 3, 2023

Description

CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker.

This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.

Scores

CVSS	Score	Vector	Source
3.1	9.3 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N	Fluid Attacks

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Cordova PluginCleverTap	2.6.2Affected

References

https://fluidattacks.com/advisories/maiden/third-party-advisory
https://github.com/CleverTap/clevertap-cordovaproduct
https://github.com/CleverTap/clevertap-cordova/releases/tag/2.7.0patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.