Weaknesses of type CWE-927

18 results

Uso de Intent implícita para comunicação sensível (Android)

Uma aplicação Android envia dados sensíveis através de uma Intent implícita, permitindo que outras apps no dispositivo interceptem ou acessem essas informações. Intents implícitas não especificam qual aplicação deve receber a mensagem, criando risco de vazamento de dados para qualquer app que declare interesse naquela ação.

Example

Uma app de banco usa Intent implícita com ação 'com.exemplo.TRANSFERENCIA' e passa credenciais ou tokens no Intent. Qualquer outra app maliciosa instalada pode registrar um receiver para 'com.exemplo.TRANSFERENCIA' e capturar os dados antes da app legítima recebê-los.

How to mitigate

Use Intent explícita, especificando o componente destinatário (Intent com setClass ou setComponent). Quando dados sensíveis envolvem, prefira mecanismos seguros como broadcast privado com permissões, ou comunique-se com serviços internos da própria aplicação. Nunca passe credenciais ou tokens em extras de Intent.

CVE-2022-4903MEDIUMCodenameOne implicit intent for sensitive communicationEPSS 0.6%CVE-2023-47889HIGHThe Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers. TheEPSS 0.3%CVE-2022-33734MEDIUMSensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connecEPSS 0.2%CVE-2022-33733MEDIUMSensitive information exposure in onCharacteristicRead in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connectioEPSS 0.2%CVE-2022-36830MEDIUMPendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version 1.2.3 allows local attackers to access fileEPSS 0.2%CVE-2022-36829MEDIUMPendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3 allows local attackers to access files withEPSS 0.2%CVE-2023-41828MEDIUM An implicit intent export vulnerability was reported in the Motorola Phone application, that could allow unauthorized access to a non-exporEPSS 0.2%CVE-2023-41826MEDIUMA PendingIntent hijacking vulnerability in Motorola Device Help (Genie) application that could allow local attackers to access files or inteEPSS 0.2%CVE-2024-3108MEDIUM An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquirEPSS 0.2%CVE-2023-41820MEDIUM An implicit intent vulnerability was reported in the Motorola Ready For application that could allow a local attacker to read information aEPSS 0.1%CVE-2024-3480LOWAn Implicit intent vulnerability was reported in the Motorola framework that could allow an attacker to read telephony-related data.EPSS 0.1%CVE-2023-41817LOWAn improper export vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read unauthorizedEPSS 0.1%CVE-2023-41824LOW An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the callingEPSS 0.1%CVE-2023-31014MEDIUMNVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on the same device canEPSS 0.1%CVE-2023-44127LOWCall management - Implicit activity intents disclose contact details and phone numbersEPSS 0.1%CVE-2023-44122MEDIUMLockScreenSettings - Theft arbitrary files with system privilegeEPSS 0.1%CVE-2023-44124MEDIUMScreen recording - Theft of arbitrary files with system privilegeEPSS 0.1%CVE-2025-48558HIGHIn multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit inteEPSS 0.1%