PT-2023-15912 · Unknown · Codenameone

Published 2023-02-10 · Updated 2024-05-17 · CVE-2022-4903

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CodenameOne version 7.0.70

Description A vulnerability was found in CodenameOne, classified as problematic. The manipulation leads to use of implicit intent for sensitive communication. It is possible to launch the attack remotely. The complexity of an attack is rather high and the exploitability is told to be difficult.

Recommendations Upgrade to version 7.0.71 to address this issue. As a temporary workaround, consider restricting the use of implicit intent for sensitive communication until the patch is applied.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-927

CWE-668

Related Identifiers

CVE-2022-4903

GHSA-P6XQ-9H8R-V544

Affected Products

Codenameone

References · 12

• https://github.com/codenameone/CodenameOne/releases/tag/7.0.71 · Patch
• https://github.com/codenameone/CodenameOne/issues/3583 · Patch
• https://github.com/codenameone/CodenameOne/commit/dad49c9ef26a598619fc48d2697151a02987d478 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4903 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4903 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p6xq-9h8r-v544 · Vendor Advisory
• https://github.com/codenameone/CodenameOne · Note
• https://vuldb.com/?id.220470 · Note
• https://t.me/cvenotify/67332 · Telegram Post
• https://vuldb.com/?ctiid.220470 · Note
• https://t.me/cvenotify/44524 · Telegram Post
• https://t.me/cibsecurity/57923 · Telegram Post