Vulnerability in Kyivstar React Native Sms User Consent
CVE-2021-4438
A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android. Affected by this issue is the function registerReceiver of the file android/src/main/java/ua/kyivstar/reactnativesmsuserconsent/SmsUserConsentModule.kt. The manipulation leads to improper export of android application components. Attacking locally is a requirement. Upgrading to version 1.1.5 is able to address this issue. The name of the patch is 5423dcb0cd3e4d573b5520a71fa08aa279e4c3c7. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-259508.
EPSS: 0.003 (17.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Kyivstar React_native_sms_user_consent
- Kyivstarteam React-native-sms-user-consent — versions 1.1.0, 1.1.1, 1.1.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, permissions-required, VDB Entry, Third Party Advisory)
- cna@vuldb.com (issue-tracking, Patch)
- cna@vuldb.com (Patch, patch)
- cna@vuldb.com (Release Notes, patch)
Frequently asked questions
- What is CVE-2021-4438?
- CVE-2021-4438 is a medium-severity vulnerability in Kyivstar React Native Sms User Consent, classified under CWE-926. CVSS score: 5.3/10. Published 2024-04-07.
- How severe is CVE-2021-4438?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2021-4438 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.