Vulnerability Details CVE-2021-43849
cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app to crash. This vulnerability occurred because the activity didn't handle the case where it is requested with invalid or empty data which results in a crash. Any third party app can constantly call this activity with no permission. A 3rd party app/attacker using event listener can continually stop the app from working and make the victim unable to open it. Version 5.0.1 of the cordova-plugin-fingerprint-aio doesn't export the activity anymore and is no longer vulnerable. If you want to fix older versions change the attribute android:exported in plugin.xml to false. Please upgrade to version 5.0.1 as soon as possible.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 23.2%
CVSS Severity
CVSS v3 Score 6.2
CVSS v2 Score 2.1
References
- https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/commit/27434a240f97f69fd930088654590c8ba43569df
- https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/releases/tag/v5.0.1
- https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/security/advisories/GHSA-7vfx-hfvm-rhr8
- https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/commit/27434a240f97f69fd930088654590c8ba43569df
- https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/releases/tag/v5.0.1
- https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/security/advisories/GHSA-7vfx-hfvm-rhr8
Products affected by CVE-2021-43849
-
Cordova Plugin Fingerprint All-In-One Project » Cordova Plugin Fingerprint All-In-One » Version: Anycpe:2.3:a:cordova_plugin_fingerprint_all-in-one_project:cordova_plugin_fingerprint_all-in-one:*
-
cpe:2.3:o:apple:iphone_os:-
-
cpe:2.3:o:google:android:10.0
-
cpe:2.3:o:google:android:11.0
-
cpe:2.3:o:google:android:12.0
-
cpe:2.3:o:google:android:12.0l
-
cpe:2.3:o:google:android:12.1
-
cpe:2.3:o:google:android:12l
-
cpe:2.3:o:google:android:13.0
-
cpe:2.3:o:google:android:13.0.0
-
cpe:2.3:o:google:android:14.0
-
cpe:2.3:o:google:android:15.0
-
cpe:2.3:o:google:android:2020-06-01
-
cpe:2.3:o:google:android:6.0
-
cpe:2.3:o:google:android:6.0.1
-
cpe:2.3:o:google:android:7.0
-
cpe:2.3:o:google:android:7.1
-
cpe:2.3:o:google:android:7.1.0
-
cpe:2.3:o:google:android:7.1.1
-
cpe:2.3:o:google:android:7.1.2
-
cpe:2.3:o:google:android:7.2
-
cpe:2.3:o:google:android:8.0
-
cpe:2.3:o:google:android:8.1
-
cpe:2.3:o:google:android:9.0