What’s Vulnerable › Vulnerabilities

CVE-2017-16905

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-01-05 · updated 2026-06-17
• Weakness: CWE-94

Description

The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, and consequently achieve remote code execution, via a man-in-the-middle attack.

Affected products

• Duolingo Tinycards: before 1.0 — fixed in 1.0

How to fix

Upgrade to a fixed version: Duolingo Tinycards 1.0. Check the vendor advisory for mitigations.

References

• https://hackerone.com/reports/281605
• https://wwws.nightwatchcybersecurity.com/2018/01/04/rce-in-duolingos-tinycards-app-for-android-cve-2017-16905/
• https://hackerone.com/reports/281605
• https://wwws.nightwatchcybersecurity.com/2018/01/04/rce-in-duolingos-tinycards-app-for-android-cve-2017-16905/

Get alerted when CVE-2017-16905 or the next vulnerability affects your stack