Vulnerability · NVD

CVE-2018-1167

HIGH 8.8 Published on 2018-04-19

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Spotify Music Player 1.0.69.336. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5501.

Attack vector : Network No privileges required

Show raw CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS 4.82% above median percentile 91.1%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

Spotify macOS com.spotify.client

Affected — Fixed in — Latest tracked 9.1.72 undetermined
Spotify iOS ios:com.spotify.client

Affected — Fixed in — Latest tracked 9.1.72 undetermined
Spotify Android com.spotify.music

Affected — Fixed in — Latest tracked 9.0.68.632 undetermined

Vulnerable CPE configurations (3)

Vendor	Product	Platform	Versions	CPE 2.3 URI
spotify	spotify All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:spotify:spotify:1.0.69.336:::::::*
spotify	spotify All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:spotify:spotify:1.0.69.336:::::::*
spotify	spotify All platforms (wildcard)	All platforms (wildcard)	—	cpe:2.3:a:spotify:spotify:1.0.69.336:::::::*

View on NVD ↗