AIKIDO-2025-10428

@havesource/cordova-plugin-push is vulnerable to Improper Export of Android Application Components

Improper Export of Android Application Components Pre-CVE

Medium Risk

This Affects:

@havesource/cordova-plugin-push

1.0.0 - 1.0.0

Fixed in 1.0.1

2.0.0 - 2.0.0

Fixed in 2.0.1

3.0.0 - 3.0.1

Fixed in 3.0.2

4.0.0 - 4.0.0

Fixed in 4.0.1

5.0.0 - 5.0.5

Fixed in 5.0.6

TL;DR

Affected versions of this package set the android:exported attribute to true for certain components in the AndroidManifest.xml file. This setting allows those components (such as activities, services, or broadcast receivers) to be invoked by external applications. If not properly restricted, this configuration can increase the risk of unauthorized access, privilege escalation, or unintended data exposure.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

@havesource/cordova-plugin-push is vulnerable to Improper Export of Android Application Components in versions 5.0.0 - 5.0.5, 4.0.0 - 4.0.0, 3.0.0 - 3.0.1, 2.0.0 - 2.0.0 and 1.0.0 - 1.0.0.