Improper input validation in Skylot Jadx
CVE-2024-32653
jadx is a Dex to Java decompiler. Prior to version 1.5.0, the package name is not filtered before concatenation. This can be exploited to inject arbitrary code into the package name. The vulnerability allows an attacker to execute comman…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.002 (14.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H.
Affected products
- Skylot Jadx — versions < 1.5.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-32653?
- CVE-2024-32653 is a medium-severity vulnerability in Skylot Jadx, classified under Improper Input Validation. CVSS score: 6.1/10. Published 2024-04-22.
- How severe is CVE-2024-32653?
- Medium severity. CVSS v3 base score is 6.1 out of 10.