CVE-2021-43849 : cordova-plugin-fingerprint-aio is a plugin provides a single and simple interfac

cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app to crash. This vulnerability occurred because the activity didn't handle the case where it is requested with invalid or empty data which results in a crash. Any third party app can constantly call this activity with no permission. A 3rd party app/attacker using event listener can continually stop the app from working and make the victim unable to open it. Version 5.0.1 of the cordova-plugin-fingerprint-aio doesn't export the activity anymore and is no longer vulnerable. If you want to fix older versions change the attribute android:exported in plugin.xml to false. Please upgrade to version 5.0.1 as soon as possible.

Published 2021-12-23 17:15:07

Updated 2022-01-11 17:39:40

Source GitHub, Inc.

View at NVD, CVE.org

Products affected by CVE-2021-43849

Cordova Plugin Fingerprint All-in-one Project » Cordova Plugin Fingerprint All-in-one » Node.js Edition
Versions before (<) 5.0.1
cpe:2.3:a:cordova_plugin_fingerprint_all-in-one_project:cordova_plugin_fingerprint_all-in-one:*:*:*:*:node.js:*:*:*
Matching versions
When used together with: Apple » Iphone Os » Version: N/A
When used together with: Google » Android

Exploit prediction scoring system (EPSS) score for CVE-2021-43849

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 19 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-43849

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:N/I:N/A:P	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
6.2	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	2.5	3.6	GitHub, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2021-43849

CWE-617 Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Assigned by: security-advisories@github.com (Primary)

References for CVE-2021-43849

https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/releases/tag/v5.0.1

Release v5.0.1 · NiklasMerz/cordova-plugin-fingerprint-aio · GitHub
Release Notes;Third Party Advisory
https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/security/advisories/GHSA-7vfx-hfvm-rhr8

Denial of service (DoS) vulnerability on Android · Advisory · NiklasMerz/cordova-plugin-fingerprint-aio · GitHub
Mitigation;Third Party Advisory
https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/commit/27434a240f97f69fd930088654590c8ba43569df

Update Fingerprint.swift · NiklasMerz/cordova-plugin-fingerprint-aio@27434a2 · GitHub
Patch;Third Party Advisory

Jump to

Vulnerability Details : CVE-2021-43849

Products affected by CVE-2021-43849

Exploit prediction scoring system (EPSS) score for CVE-2021-43849

CVSS scores for CVE-2021-43849

CWE ids for CVE-2021-43849

References for CVE-2021-43849