Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2017-0911

Quick assessment

Affected
Twitter Twitter Kit for iOS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Twitter Kit for iOS是一套基于iOS平台的开源的用于与Twitter进行无缝交互的本地开发工具包。Login with Twitter component是其中的一个登陆组件。 基于iOS平台的Twitter Kit 3.0版本至3.2.1版本中的Login with Twitter组件存在安全漏洞。攻击者可利用该漏洞提交代替性的凭证，使推特账户与第三方服务发生关联。

AI Predicted 5.9 Difficulty: Easy EPSS 0.50% · P41
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2017-0911

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter" authentication information is passed back to the application using the registered custom URL scheme (typically twitterkit-<consumer-key>) on iOS. Because the callback handler did not verify the authenticity of the response, this step is vulnerable to forgery, potentially allowing attacker to associate a Twitter account with a third-party service.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
信任系统事件数据
Source: CVE Program / CVE List V5
Vulnerability Title
Twitter Kit for iOS Login with Twitter组件安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Twitter Kit for iOS是一套基于iOS平台的开源的用于与Twitter进行无缝交互的本地开发工具包。Login with Twitter component是其中的一个登陆组件。 基于iOS平台的Twitter Kit 3.0版本至3.2.1版本中的Login with Twitter组件存在安全漏洞。攻击者可利用该漏洞提交代替性的凭证，使推特账户与第三方服务发生关联。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Twitter Twitter Kit for iOS Versions 3.0 to 3.2.1 -

II. Public POCs for CVE-2017-0911

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2017-0911

请登录查看更多情报信息。

Security Blog Posts for CVE-2017-0911 (1)

Other References for CVE-2017-0911 (4)

IV. Related Vulnerabilities

Same product: Twitter Kit for iOS
Same vendor: Twitter
Same weakness: CWE-360

V. Comments for CVE-2017-0911

No comments yet

Leave a comment