CyberRota Analysis
AI-GeneratedThe CleverTap Web SDK v1.15.1 is susceptible to Cross Site Scripting (XSS) due to inadequate sanitization of untrusted data received via window.postMessage, allowing attackers to execute arbitrary JavaScript in the context of the hosting site. This vulnerability poses a risk to applications utilizing this SDK, particularly those that handle user-generated content or integrate with third-party services. Developers and security teams using this version of the SDK should prioritize remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of arbitrary JavaScript in the context of the hosting site.