Back to Database
Status published
High
CVE-2019-16263
The Twitter Kit framework through 3.4.2 for iOS does not...
Vulnerability Description
The Twitter Kit framework through 3.4.2 for iOS does not properly validate the api.twitter.com SSL certificate. Although the certificate chain must contain one of a set of pinned certificates, there are certain implementation errors such as a lack of hostname verification. NOTE: this is an end-of-life product.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-16263
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/twitter-archive/twitter-kit-ios/blob/ac42e1351a66afa5ff7718d04d64a905dafe1f41/TwitterCore/TwitterCore/Networking/Security/TWTRServerTrustEvaluator.m#L75-L81
- https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_TwitterKit_for_iOS_CVE-2019-16263.pdf
- https://blog.appicaptor.com/2019/10/04/vulnerable-library-warning-twitterkit-for-ios/
More from twitter
View All →CVE-2020-35774
server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some...
Medium
5.4
CVE-2016-10511
The Twitter iOS client versions 6.62 and 6.62.1 fail to...
Medium
5.9
CVE-2014-6838
The Groupama toujours la (aka com.groupama.toujoursla) application 1.3.0 for Android...
Medium
5.4
Affected Vendor
Affected Software
twitter kit
Vulnerable Versions:
0
Timeline
Official Publish:
October 7th, 2019
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.