skylot/jadx · Security
Improper Restriction of XML External Entity Reference in skylot/jadx
- GHSA ID
- GHSA-r8j4-96mx-rjcc
- CVE ID
- CVE-2022-0219
- Severity
- medium
- Published
- Updated
- CVSS
- 5.5 · CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- CVSS v3
- 5.5 · CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Description
skylot/jadx prior to 1.3.2 is vulnerable to Improper Restriction of XML External Entities when a user is tricked into exporting a malicious APK file (via the -e option) containing a crafted AndroidManifest.xml / strings.xml to gradle, leading to possible local file disclosure.
CWEs
- CWE-611 · Improper Restriction of XML External Entity Reference