CVE-2024-21668

{"id": "CVE-2024-21668", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2024-01-09T19:15:12.330", "references": [{"url": "https://github.com/mrousavy/react-native-mmkv/commit/a8995ccb7184281f7d168bad3e9987c9bd05f00d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mrousavy/react-native-mmkv/releases/tag/v2.11.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mrousavy/react-native-mmkv/security/advisories/GHSA-4jh3-6jhv-2mgp", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mrousavy/react-native-mmkv/commit/a8995ccb7184281f7d168bad3e9987c9bd05f00d", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/mrousavy/react-native-mmkv/releases/tag/v2.11.0", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/mrousavy/react-native-mmkv/security/advisories/GHSA-4jh3-6jhv-2mgp", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0."}, {"lang": "es", "value": "react-native-mmkv es una librer\u00eda que permite el uso sencillo de MMKV dentro de aplicaciones React Native. Antes de la versi\u00f3n 2.11.0, react-native-mmkv registraba la clave de cifrado opcional para la base de datos MMKV en el registro del sistema Android. Cualquier persona con acceso al Android Debugging Bridge (ADB) puede obtener la clave si est\u00e1 habilitado en la configuraci\u00f3n del tel\u00e9fono. Este error no est\u00e1 presente en dispositivos iOS. Al registrar el secreto de cifrado en los registros del sistema, los atacantes pueden recuperar trivialmente el secreto habilitando ADB y socavando el modelo de subprocesos de una aplicaci\u00f3n. Este problema se solucion\u00f3 en la versi\u00f3n 2.11.0."}], "lastModified": "2024-11-21T08:54:49.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mrousavy:react-native-mmkv:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "2F0F4C50-CDEB-4A18-A8BC-E087D59E6D75", "versionEndExcluding": "2.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}