GitHub Advisoryadvisory · Maven

GHSA-r8j4-96mx-rjcc Improper Restriction of XML External Entity Reference in skylot/jadx

MEDIUM Published 2022-01-21 Modified 2022-02-24 Official page ↗
Aliases
CVE-2022-0219
Ecosystem
Maven
Packages
io.github.skylot:jadx-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2022-01-21

Affected packages

• Maven io.github.skylot:jadx-core: < 1.3.2 → fixed in 1.3.2

Description

skylot/jadx prior to 1.3.2 is vulnerable to Improper Restriction of XML External Entities when a user is tricked into exporting a malicious APK file (via the -e option) containing a crafted AndroidManifest.xml / strings.xml to gradle, leading to possible local file disclosure.

Related

Alias · CVE (1)

  • CVE-2022-0219 Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References