CVE-2025-14517
BaseFortify
Publication date: 2025-12-11
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yalantis | ucrop | 2.2.11 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-926 | The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Yalantis uCrop version 2.2.11, specifically in the UCropActivity function within the AndroidManifest.xml file. It allows an attacker with local access to manipulate the application, leading to improper export of Android application components. This means that certain components of the app may be exposed or accessible in ways not intended by the developer.
How can this vulnerability impact me? :
The vulnerability can lead to improper export of application components, which may allow a local attacker to access or manipulate parts of the application that should be protected. This can compromise the confidentiality, integrity, and availability of the application and its data, potentially leading to unauthorized information disclosure or modification.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by inspecting the AndroidManifest.xml file of the uCrop 2.2.11 application to check if the UCropActivity component is improperly exported. Since the exploit requires local access, detection involves verifying the export status of UCropActivity. Additionally, attackers may use Google dorking with queries like 'inurl:AndroidManifest.xml' to identify vulnerable targets. Specific commands to detect this locally could include using 'grep' to search for 'UCropActivity' and 'exported' attributes in the AndroidManifest.xml, for example: grep -A 5 'UCropActivity' AndroidManifest.xml | grep exported. However, no automated detection tools or network-based detection commands are provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include considering replacing the affected uCrop 2.2.11 component or product, as no patches or countermeasures are currently available. Since the vendor did not respond or provide a fix, users should avoid using the vulnerable version or restrict local access to the affected application to prevent exploitation. Reviewing and modifying the AndroidManifest.xml to ensure that UCropActivity is not improperly exported (i.e., setting exported="false" or applying proper access restrictions) could also help mitigate the risk. [1]