GSD-2021-1000040

    Dashboard / Vulnerabilities / GSD-2021-1000040

    GSD-2021-1000040

    Published: 31 May 2021Last Modified: 14 Mar 2023

    Summary: update freeze attack in DroidScript version all versions

    Details: DroidScript, all versions, were removed from the Google store after allegations of malware and ad fraud surfaced from Google. It is reported that ad clicking activity did take place but that it was not as a direct result from DriodScript themselves. However due to the removal of DroidScript it is unlikely that many DroidScript based applications will receive security updates, creating a significant vulnerability (effectively an update freeze attack).

    References: https://groups.google.com/g/androidscript/c/Mbh5TZ6YYnA/m/GflwflqaDAAJ, https://droidscript.org/, https://twitter.com/droidscript/status/1385956513433456640?ref_src=twsrc%5Etfw%7Ctwcamp%5Eembeddedtimeline%7Ctwterm%5Eprofile%3Adroidscript%7Ctwgr%5EeyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D%7Ctwcon%5Etimelinechrome&ref_url=https%3A%2F%2Fdroidscript.org%2Fnews-2%2F

    Affected packages

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GSD-2021-1000040 | CVE-DB