CVE-2019-14756 - CVE House
Back to Database
Status published Medium CVE-2019-14756

An issue was discovered in KaiOS 1.0, 2.5, and 2.5.12.5....

Vulnerability Description

An issue was discovered in KaiOS 1.0, 2.5, and 2.5.12.5. The pre-installed Email application is vulnerable to HTML and JavaScript injection attacks. An attacker can send a specially crafted email to the victim that will inject HTML into the email application's UI as soon as the email is opened. At a bare minimum, this allows an attacker to take control over the Email application's UI (e.g., display a malicious prompt to the user asking them to re-enter their email credentials) and also allows an attacker to abuse any of the privileges available to the mobile application.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-14756

Credits & Attribution

No credits recorded in the NVD database.

References

More from kaiostech

View All →
CVE-2019-7386
A Denial of Service issue has been discovered in the...
Medium 6.5
CVE-2019-14761
An issue was discovered in KaiOS 2.5. The pre-installed Note...
Medium 4.4
CVE-2019-14760
An issue was discovered in KaiOS 2.5. The pre-installed Recorder...
Medium 4.4
CVE-2019-14759
An issue was discovered in KaiOS 1.0, 2.5, and 2.5.1....
Medium 4.4
CVE-2019-14758
An issue was discovered in KaiOS 2.5 and 2.5.1. The...
Medium 6.1

Affected Vendor

Affected Software

kaios
Vulnerable Versions:
1.0, 2.5, 2.5.12.5

Timeline

Official Publish: September 14th, 2020
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.