Intent Redirection Vulnerability in Sina Weibo Android SDK
CVE-2020-23349

7.5HIGH

Key Information:

Vendor

Weibo

Status
Android Software Development Kit
Vendor
CVE Published:
5 April 2022

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-23349?

A vulnerability exists in the Sina Weibo Android SDK 4.2.7 where an intent redirection issue allows unexported Activities to be launched unexpectedly by the WbShareTransActivity. This could lead to unauthorized access and potential compromise of application security, making it crucial for developers to mitigate risks associated with this flaw.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-23349_Lab
Created by LazyBear8372

References

https://github.com/sinaweibosdk/weibo_android_sdk/issues/406
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.