Skip to content
Appaloosa Scout
Language selector
fr en

Vulnerability · NVD

CVE-2018-1167

CVE-2018-1167, high severity (CVSS 8.8): 3 tracked apps concerned, all fixed or indeterminable on their current version.

Severity (CVSS)
8.8

NVD scale

Exploitation
4.6 %

EPSS, predicted over 30 days

Tracked apps
3
Still exposed
0

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Spotify Music Player 1.0.69.336. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5501.

Attack vector : Network No privileges required
Show raw CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS 4.56% above median percentile 91.3%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

  • Spotify macOS com.spotify.client
    Affected - Fixed in - Latest tracked 9.1.86 undetermined
  • Spotify iOS ios:com.spotify.client
    Affected - Fixed in - Latest tracked 9.1.86 undetermined
  • Spotify Android com.spotify.music
    Affected - Fixed in - Latest tracked 9.1.80.2221 undetermined
Vulnerable CPE configurations (3)
Vendor Product Versions
spotify spotify
All platforms (wildcard)
 -
spotify spotify
All platforms (wildcard)
 -
spotify spotify
All platforms (wildcard)
 -
View on NVD ↗

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM