firebase-measurement-connector-19.0.0.aar: 1 vulnerabilities (highest severity is: 6.1)

[appcues-wss]

Vulnerable Library - firebase-measurement-connector-19.0.0.aar

Path to dependency file: /appcues/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.android.gms/play-services-basement/18.0.0/1a4fdb03eefb2ab366885414496749b003fb6948/play-services-basement-18.0.0.pom

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (firebase-measurement-connector version)	Remediation Possible**
CVE-2022-2390	Medium	6.1	play-services-basement-18.0.0.aar	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-2390

Vulnerable Library - play-services-basement-18.0.0.aar

Path to dependency file: /samples/kotlin-android-app/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.android.gms/play-services-basement/18.0.0/1a4fdb03eefb2ab366885414496749b003fb6948/play-services-basement-18.0.0.pom

Dependency Hierarchy:

• firebase-measurement-connector-19.0.0.aar (Root Library)
  • ❌ play-services-basement-18.0.0.aar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.

Publish Date: 2022-08-12

URL: CVE-2022-2390

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cm6r-892j-jv2g

Release Date: 2022-08-12

Fix Resolution: com.google.android.gms:play-services-basement:18.0.2