GHSA-r956-2553-vvhr

Suggest an improvement
Source
https://github.com/advisories/GHSA-r956-2553-vvhr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-r956-2553-vvhr/GHSA-r956-2553-vvhr.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-r956-2553-vvhr
Aliases
Published
2024-04-07T09:30:29Z
Modified
2024-04-10T19:12:55.688826Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
React Native Sms User Consent Intent Redirection Vulnerability
Details

A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android. Affected by this issue is the function registerReceiver of the file android/src/main/java/ua/kyivstar/reactnativesmsuserconsent/SmsUserConsentModule.kt. The manipulation leads to improper export of android application components. Attacking locally is a requirement. Upgrading to version 1.1.5 is able to address this issue. The name of the patch is 5423dcb0cd3e4d573b5520a71fa08aa279e4c3c7. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-259508.

Database specific
{
    "nvd_published_at": "2024-04-07T09:15:07Z",
    "cwe_ids": [
        "CWE-926"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-08T15:45:37Z"
}
References

Affected packages

npm / @kyivstarteam/react-native-sms-user-consent

Package

Name
@kyivstarteam/react-native-sms-user-consent
View open source insights on deps.dev
Purl
pkg:npm/%40kyivstarteam/react-native-sms-user-consent

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.5