CVE-2025-65835

Katalog CVE

CVSS 6.2 · Medium EPSS 0,28%

Kerentanan NULL Pointer Dereference pada eddyverbruggen cordova-plugin-x-socialsharing. Skor CVSS 3.1 6.2 (Medium) menurut CISA ADP.

Deskripsi (NVD)

The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4, registers an exported broadcast receiver nl.xservices.plugins.ShareChooserPendingIntent with an android.intent.action.SEND intent filter. The onReceive implementation accesses Intent.EXTRA_CHOSEN_COMPONENT without checking for null. If a broadcast is sent with extras present but without EXTRA_CHOSEN_COMPONENT, the code dereferences a null value and throws a NullPointerException. Because the receiver is exported and performs no permission or caller validation, any local application on the device can send crafted ACTION_SEND broadcasts to this component and repeatedly crash the host application, resulting in a local, unauthenticated application-level denial of service for any app that includes the plugin.

Rincian

Terbit di NVD

15 Desember 2025

Terakhir diubah

15 September 2026

Status NVD

Analyzed

CVSS 3.1

6.2 (Medium), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://medium.com/@lcrawfqrd/local-dos-via-exported-receivers-f6b1da10d3b7 exploit · advisory pihak ketiga
• https://github.com/EddyVerbruggen/SocialSharing-PhoneGap-Plugin product
• https://www.npmjs.com/package/cordova-plugin-x-socialsharing product