CVE-2021-43849

DoS vulnerability

Description

cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app to crash. This vulnerability occurred because the activity didn't handle the case where it is requested with invalid or empty data which results in a crash. Any third party app can constantly call this activity with no permission. A 3rd party app/attacker using event listener can continually stop the app from working and make the victim unable to open it. Version 5.0.1 of the cordova-plugin-fingerprint-aio doesn't export the activity anymore and is no longer vulnerable. If you want to fix older versions change the attribute android:exported in plugin.xml to false. Please upgrade to version 5.0.1 as soon as possible.

Category

6.2
CVSS
Severity: Medium
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.07%
Third-Party Advisory github.com Third-Party Advisory github.com Third-Party Advisory github.com
Affected: NiklasMerz cordova-plugin-fingerprint-aio
Published at:
Updated at:

References

Link Tags
https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/security/advisories/GHSA-7vfx-hfvm-rhr8 mitigation third party advisory
https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/commit/27434a240f97f69fd930088654590c8ba43569df third party advisory patch
https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/releases/tag/v5.0.1 third party advisory release notes

Frequently Asked Questions

What is the severity of CVE-2021-43849?
CVE-2021-43849 has been scored as a medium severity vulnerability.
How to fix CVE-2021-43849?
To fix CVE-2021-43849, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2021-43849 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2021-43849 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2021-43849?
CVE-2021-43849 affects NiklasMerz cordova-plugin-fingerprint-aio.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.