FKIE_CVE-2013-5726

Vulnerability from fkie_nvd - Published: 2013-11-12 20:55 - Updated: 2026-06-16 23:59
Severity
Summary
Tweetbot 1.3.3 for Mac, and 2.8.5 for iPad and iPhone, does not require confirmation of (1) follow or (2) favorite actions, which allows remote attackers to automatically force the user to perform undesired actions, as demonstrated via the tweetbot:///follow/ URL.
References
cve@mitre.orghttp://blog.binaryfactory.ca/2013/11/cve-2013-5726-tweetbot-for-ios-and-mac-user-disclosureprivacy-issue/Exploit
cve@mitre.orghttp://osvdb.org/99256
cve@mitre.orghttp://seclists.org/fulldisclosure/2013/Nov/9Exploit
af854a3a-2127-422b-91ae-364da2661108http://blog.binaryfactory.ca/2013/11/cve-2013-5726-tweetbot-for-ios-and-mac-user-disclosureprivacy-issue/Exploit
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/99256
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2013/Nov/9Exploit
Impacted products
Vendor Product Version
tapbots tweetbot 1.3.3
tapbots tweetbot 2.8.5
tapbots tweetbot 2.8.5
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tapbots:tweetbot:1.3.3:-:*:*:*:mac:*:*",
              "matchCriteriaId": "C3E6D204-A72F-41B7-B091-AE4A0BD871AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tapbots:tweetbot:2.8.5:-:*:*:*:ipad:*:*",
              "matchCriteriaId": "4EEEC4B9-1D7F-435B-920D-24AF39C758EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tapbots:tweetbot:2.8.5:-:*:*:*:iphone:*:*",
              "matchCriteriaId": "2C66EF3D-9C61-4941-9944-0FB6D9A0CFD1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tweetbot 1.3.3 for Mac, and 2.8.5 for iPad and iPhone, does not require confirmation of (1) follow or (2) favorite actions, which allows remote attackers to automatically force the user to perform undesired actions, as demonstrated via the tweetbot:///follow/ URL."
    },
    {
      "lang": "es",
      "value": "Tweetbot 1.3.3 para Mac, y 2.8.5 para iPad y iPhone, no requiere confirmaci\u00f3n de (1) seguimiento o (2) acciones favoritas, lo que permite a atacantes remotos forzar autom\u00e1ticamente al usuario para realizar acciones no deseadas, tal y como se demostr\u00f3 a trav\u00e9s de la URL tweetbot:///follow/."
    }
  ],
  "id": "CVE-2013-5726",
  "lastModified": "2026-06-16T23:59:19.253",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2013-11-12T20:55:04.483",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://blog.binaryfactory.ca/2013/11/cve-2013-5726-tweetbot-for-ios-and-mac-user-disclosureprivacy-issue/"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/99256"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/fulldisclosure/2013/Nov/9"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://blog.binaryfactory.ca/2013/11/cve-2013-5726-tweetbot-for-ios-and-mac-user-disclosureprivacy-issue/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/99256"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/fulldisclosure/2013/Nov/9"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.