CVE-2023-29748

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Story Saver for Instragram - Video Downloader 1.0.6 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method to inject a large amount of data into any SharedPreference file, which will be loaded into memory when the application is opened. When an attacker injects too much data, the application will trigger an OOM error and crash at startup, resulting in a persistent denial of service.

Story Saver para Instagram - Vídeo Downloader v1.0.6 para Android tiene un componente expuesto que proporciona un método para modificar el archivo "SharedPreference". Un atacante puede aprovechar este método para inyectar una gran cantidad de datos en cualquier archivo "SharedPreference", que se cargará en la memoria cuando se abra la aplicación. Cuando un atacante inyecta demasiados datos, la aplicación desencadenará un error "OOM" y se bloqueará al iniciarse, lo que provocará una denegación de servicio persistente.

*Credits: N/A

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-04-07 CVE Reserved
2023-06-01 CVE Published
2024-07-03 EPSS Updated
2024-08-02 CVE Updated
2024-08-02 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (4)

URL	Tag	Source
https://apksos.com/app/story.saver.downloader.photo.video.repost.byrk	Product
https://play.google.com/store/apps/details?id=ru.yandex.yandexnavi	Not Applicable
https://www.instagram.com/nihans_macrame	Not Applicable

URL	Date	SRC
https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29748/CVE%20detail.md	2024-08-02

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Story Saver For Instagram - Video Downloader Project Search vendor "Story Saver For Instagram - Video Downloader Project"		Story Saver For Instagram - Video Downloader Search vendor "Story Saver For Instagram - Video Downloader Project" for product "Story Saver For Instagram - Video Downloader"				1.0.6 Search vendor "Story Saver For Instagram - Video Downloader Project" for product "Story Saver For Instagram - Video Downloader" and version "1.0.6"		android		Affected