VULNERABILITY INTELLIGENCE

CVE-2023-1384

CVSS score6.1 MEDIUM

EPSS probability0.38%

CISA KEVNot currently listed

Published2023-05-03

Last modified2026-06-17

Description

The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3.