Description
Before version v2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices.
Recommendation
Update the react-native-mmkv package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.11.0
- Patched version(s): 2.11.0
References
Could your website be exposed too?
SmartScanner can check your website for react-native-mmkv Insertion of Sensitive Information into Log File vulnerability and gives you actionable findings to investigate.
Start a free scanRelated Issues
- React Native Document Picker Directory Traversal vulnerability - CVE-2024-25466
- React Native Sms User Consent Intent Redirection Vulnerability - CVE-2021-4438
- VvvebJs Arbitrary File Upload vulnerability - CVE-2024-29272
- Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo - CVE-2024-21548
You might also like:
See something that needs correcting? Let us knowUpdated January 19, 2024