search

appcues / appcues-android-sdk

The Appcues Android SDK
https://www.appcues.com/mobile
MIT License
10 stars 3 forks source link

firebase-measurement-connector-19.0.0.aar: 1 vulnerabilities (highest severity is: 6.1) #637

Open appcues-wss[bot] opened 2 months ago

appcues-wss[bot] commented 2 months ago
Vulnerable Library - firebase-measurement-connector-19.0.0.aar

Path to dependency file: /appcues/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.android.gms/play-services-basement/18.0.0/1a4fdb03eefb2ab366885414496749b003fb6948/play-services-basement-18.0.0.pom

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (firebase-measurement-connector version) Remediation Possible**
CVE-2022-2390 Medium 6.1 play-services-basement-18.0.0.aar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-2390 ### Vulnerable Library - play-services-basement-18.0.0.aar

Path to dependency file: /samples/kotlin-android-app/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.android.gms/play-services-basement/18.0.0/1a4fdb03eefb2ab366885414496749b003fb6948/play-services-basement-18.0.0.pom

Dependency Hierarchy: - firebase-measurement-connector-19.0.0.aar (Root Library) - :x: **play-services-basement-18.0.0.aar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.

Publish Date: 2022-08-12

URL: CVE-2022-2390

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-cm6r-892j-jv2g

Release Date: 2022-08-12

Fix Resolution: com.google.android.gms:play-services-basement:18.0.2