CVE-2021-4438 json
kyivstarteam react-native-sms-user-consent SmsUserConsentModule.kt registerReceiver improper export of android application components
published 2024-04-07 2 y ago modified 2026-06-17 4 mo ago also GHSA-r956-2553-vvhr , EUVD-2024-1296
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 17%
- public exploits
- 0
- none known
Summary
A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android. Affected by this issue is the function registerReceiver of the file android/src/main/java/ua/kyivstar/reactnativesmsuserconsent/SmsUserConsentModule.kt. The manipulation leads to improper export of android application components. Attacking locally is a requirement. Upgrading to version 1.1.5 is able to address this issue. The name of the patch is 5423dcb0cd3e4d573b5520a71fa08aa279e4c3c7. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-259508.
Patch / fix
- npm @kyivstarteam/react-native-sms-user-consent 1.1.5
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 4.3 | AV:L/AC:L/Au:S/C:P/I:P/A:P |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @kyivstarteam/react-native-sms-user-consent | <1.1.5 |
1.1.5 |
Affected products
- kyivstarteam react-native-sms-user-consent
Classification
- Weakness
-
- CWE-926 Improper Export of Android Application Components
References
-
github.com
/kyivstarteam/react-native-sms-user-consent/pull/4
issue-tracking, web, patch
-
github.com
/kyivstarteam/react-native-sms-user-consent/commit/5423dcb0cd3e4d573b5520a71fa08aa279e4c3c7
patch, web
-
github.com
/kyivstarteam/react-native-sms-user-consent/releases/tag/1.1.5
patch, web, release-notes
-
vuldb.com
/?id.259508
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.259508
signature, permissions-required, web, third-party-advisory, vdb-entry
-
nvd.nist.gov
/vuln/detail/CVE-2021-4438
advisory
-
github.com
/kyivstarteam/react-native-sms-user-consent
package
Sources
- CVE List CVE-2021-4438
- GitHub Advisory GHSA-r956-2553-vvhr
- NVD CVE-2021-4438
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.