Description

There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows construction of arbitrary java classes. This can lead to arbitrary code execution when combined with specific Java deserialization gadgets. An attacker needs to install a malicious application on victims device to be able to attack any application that uses vulnerable library. We recommend upgrading the library past version 1.7.0-beta02.

INFO

Published Date :

2024-11-20T10:21:20.473Z

Last Modified :

2025-01-06T17:50:37.410Z

Source :

Google
AFFECTED PRODUCTS

The following products are affected by CVE-2024-10382 vulnerability.

Vendors Products
Google
  • Android
  • Androidx.car.app
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-10382.

URL Resource
https://developer.android.com/jetpack/androidx/releases/car-app#1.7.0-beta03 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact