PT-2021-23978 · Unknown · Cordova-Plugin-Fingerprint-Aio

0Xwise64 · Published 2021-12-23 · Updated 2023-11-02 · CVE-2021-43849

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: cordova-plugin-fingerprint-aio versions prior to 5.0.1

Description: The exported activity de.niklasmerz.cordova.biometric.BiometricActivity can cause the app to crash when requested with invalid or empty data. Any third-party app can constantly call this activity with no permission, and a 3rd party app/attacker using an event listener can continually stop the app from working, making the victim unable to open it. This issue results in a denial of service (DoS) condition.

Recommendations: For versions prior to 5.0.1, change the attribute android:exported in plugin.xml to false to fix the issue. Upgrade to version 5.0.1 as soon as possible.

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2021-43849

GHSA-7VFX-HFVM-RHR8

Affected Products

Cordova-Plugin-Fingerprint-Aio

References · 10

• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/commit/27434a240f97f69fd930088654590c8ba43569df · Patch
• https://osv.dev/vulnerability/GHSA-7vfx-hfvm-rhr8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43849 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43849 · Security Note
• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/releases/tag/v5.0.1 · Note
• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/security/advisories/GHSA-7vfx-hfvm-rhr8 · Note
• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio · Note
• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/discussions/394 · Note
• https://t.me/cibsecurity/34575 · Telegram Post
• https://t.me/cvenotify/25250 · Telegram Post