CVE-2021-43849

Katalog CVE

CVSS 5.5 · Medium EPSS 0,33%

Kerentanan Reachable Assertion pada cordova plugin fingerprint all-in-one project cordova plugin fingerprint all-in-one. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app to crash. This vulnerability occurred because the activity didn't handle the case where it is requested with invalid or empty data which results in a crash. Any third party app can constantly call this activity with no permission. A 3rd party app/attacker using event listener can continually stop the app from working and make the victim unable to open it. Version 5.0.1 of the cordova-plugin-fingerprint-aio doesn't export the activity anymore and is no longer vulnerable. If you want to fix older versions change the attribute android:exported in plugin.xml to false. Please upgrade to version 5.0.1 as soon as possible.

Rincian

Terbit di NVD

23 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-617: Reachable Assertion

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/commit/27434a240f97f69fd930088654590c8ba43569df patch · advisory pihak ketiga
• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/security/advisories/GHSA-7vfx-hfvm-rhr8 mitigasi · advisory pihak ketiga
• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/releases/tag/v5.0.1 release notes · advisory pihak ketiga