GitHub Advisoryadvisory · Maven

GHSA-p6xq-9h8r-v544 CodenameOne Pending Intent vulnerability

CRITICAL Published 2023-02-10 Modified 2024-01-16 Official page ↗
Aliases
CVE-2022-4903
Ecosystem
Maven
Packages
com.codenameone:codenameone-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-668, CWE-927
Reviewed
2024-01-16

Affected packages

• Maven com.codenameone:codenameone-core: < 7.0.71 → fixed in 7.0.71

Description

A vulnerability was found in CodenameOne 7.0.70. The manipulation leads to use of implicit intent for sensitive communication. It is possible to launch the attack remotely. Upgrading to version 7.0.71 is able to address this issue. The name of the patch is dad49c9ef26a598619fc48d2697151a02987d478. It is recommended to upgrade the affected component.

Related

Alias · CVE (1)

  • CVE-2022-4903 A vulnerability was found in CodenameOne 7.0.70. vulnerability

Weakness · CWE (2)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness
  • CWE-927 Use of Implicit Intent for Sensitive Communication weakness

References