High – 7.2
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:H/SI:H/SA:H

PT-2024-35: Automatic explicit deep link assignment in Android Jetpack Navigation Library

Error type:

Vulnerability vector:

  • Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
  • Severity (CVSSv3.1): 7.8 (high)
  • Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:H/SI:H/SA:H
  • Severity (CVSSv4.0): 7.2 (high)

Description:

The vulnerability was identified in Android Jetpack Navigation Library in versions <2.8.1.

The discovered vulnerability allows an attacker, using automatically assigned explicit deep links, to open arbitrary screens in the application and pass them arbitrary parameters

Vulnerability status: Confirmed by research

Date of vulnerability remediation: 18.09.2024

Recommendations:

  • Update to version ≥ 2.8.1

Additional information:

Researcher: Artem Kulakov (Positive Technologies)

Vendor:

Google

Vulnerable product:

Android Jetpack Navigation Library

Vulnerable versions:

<2.8.1