CVE-2026-47363

Katalog CVE

CVSS 6.3 · Medium EPSS 0,26%

Kerentanan Improper Export of Android Application Components. Skor CVSS 3.1 6.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app. Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.

Rincian

Terbit di NVD

7 Agustus 2026

Terakhir diubah

3 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

6.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-926: Improper Export of Android Application Components

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://cwe.mitre.org/data/definitions/926.html
• https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef