Skip to content
Sign in
4.3 Medium

CVE-2023-1384 The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for…

Description

The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3.

Affected products and versions

Product Affected versions Fixed in
Fire TV Stick 3rd gen 6.2.9.4 No fix stated
TV with FireOS 7.6.3.2 No fix stated

Other CVEs of Fire TV Stick 3rd gen

The 2 CVEs of Fire TV Stick 3rd gen →
CVE-2023-1385 Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known… 7.1 High
Track this CVE