CVE-2023-1384

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run

This issue affects:

Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 3, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-13858.8Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to uCVE-2023-13867.8A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file wiCVE-2023-13877.5Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to searcCVE-2023-13888.1A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory CVE-2023-13898.8TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form oCVE-2023-13907.5A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknCVE-2023-13919.8A vulnerability, which was classified as problematic, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is CVE-2023-13929.8A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerabilityCVE-2023-13937.8A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys thCVE-2023-13949.8A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been classified as critical. This affects the functionCVE-2023-13956.1A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as problematic. This vulnerability affeCVE-2023-13966.1A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as problematic. This issue affec
CVE-2023-1384: Medium severity, CVSS 6.1 | Vulnix