CVE-2025-14517
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-11

Last updated on: 2026-04-29

Assigner: VulDB

Description
A vulnerability was determined in Yalantis uCrop 2.2.11. This affects the function UCropActivity  of the file AndroidManifest.xml. Executing manipulation can lead to improper export of android application components. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-11
Last Modified
2026-04-29
Generated
2026-05-07
AI Q&A
2025-12-11
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
yalantis ucrop 2.2.11
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-926 The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in Yalantis uCrop version 2.2.11, specifically in the UCropActivity function within the AndroidManifest.xml file. It allows an attacker with local access to manipulate the application, leading to improper export of Android application components. This means that certain components of the app may be exposed or accessible in ways not intended by the developer.


How can this vulnerability impact me? :

The vulnerability can lead to improper export of application components, which may allow a local attacker to access or manipulate parts of the application that should be protected. This can compromise the confidentiality, integrity, and availability of the application and its data, potentially leading to unauthorized information disclosure or modification.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by inspecting the AndroidManifest.xml file of the uCrop 2.2.11 application to check if the UCropActivity component is improperly exported. Since the exploit requires local access, detection involves verifying the export status of UCropActivity. Additionally, attackers may use Google dorking with queries like 'inurl:AndroidManifest.xml' to identify vulnerable targets. Specific commands to detect this locally could include using 'grep' to search for 'UCropActivity' and 'exported' attributes in the AndroidManifest.xml, for example: grep -A 5 'UCropActivity' AndroidManifest.xml | grep exported. However, no automated detection tools or network-based detection commands are provided in the resources. [1]


What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps include considering replacing the affected uCrop 2.2.11 component or product, as no patches or countermeasures are currently available. Since the vendor did not respond or provide a fix, users should avoid using the vulnerable version or restrict local access to the affected application to prevent exploitation. Reviewing and modifying the AndroidManifest.xml to ensure that UCropActivity is not improperly exported (i.e., setting exported="false" or applying proper access restrictions) could also help mitigate the risk. [1]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart