{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-9134", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-08-19T05:19:38.014Z", "datePublished": "2025-08-19T10:32:06.355Z", "dateUpdated": "2025-08-19T13:17:45.555Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-08-19T10:32:06.355Z"}, "title": "AfterShip Package Tracker App com.aftership.AfterShip AndroidManifest.xml improper export of android application components", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-926", "lang": "en", "description": "Improper Export of Android Application Components"}]}], "affected": [{"vendor": "AfterShip", "product": "Package Tracker App", "versions": [{"version": "5.24.0", "status": "affected"}, {"version": "5.24.1", "status": "affected"}], "modules": ["com.aftership.AfterShip"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in AfterShip Package Tracker App up to 5.24.1 on Android. The affected element is an unknown function of the file AndroidManifest.xml of the component com.aftership.AfterShip. The manipulation leads to improper export of android application components. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure and replied: \"After reviewing your report, we have confirmed that this vulnerability does indeed exist and we are actively working to fix it.\""}, {"lang": "de", "value": "In AfterShip Package Tracker App bis 5.24.1 auf Android wurde eine Schwachstelle gefunden. Hiervon betroffen ist ein unbekannter Codeblock der Datei AndroidManifest.xml der Komponente com.aftership.AfterShip. Die Ver\u00e4nderung resultiert in improper export of android application components. Der Angriff muss lokal angegangen werden. Die Ausnutzung wurde ver\u00f6ffentlicht und kann verwendet werden."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2025-08-19T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-08-19T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-08-19T07:27:38.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "fxizenta (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.320514", "name": "VDB-320514 | AfterShip Package Tracker App com.aftership.AfterShip AndroidManifest.xml improper export of android application components", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.320514", "name": "VDB-320514 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.615253", "name": "Submit #615253 | Aftership(https://www.aftership.com/mobile-app) AfterShip 5.24.1 Task Hijacking", "tags": ["third-party-advisory"]}, {"url": "https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md", "tags": ["related"]}, {"url": "https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md#steps-to-reproduce", "tags": ["exploit"]}]}, "adp": [{"references": [{"url": "https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md#steps-to-reproduce", "tags": ["exploit"]}, {"url": "https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-19T13:17:42.438056Z", "id": "CVE-2025-9134", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-19T13:17:45.555Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in AfterShip Package Tracker App up to 5.24.1 on Android. The affected element is an unknown function of the file AndroidManifest.xml of the component com.aftership.AfterShip. The manipulation leads to improper export of android application components. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure and replied: \"After reviewing your report, we have confirmed that this vulnerability does indeed exist and we are actively working to fix it.\""}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad de seguridad en la aplicaci\u00f3n AfterShip Package Tracker (hasta la versi\u00f3n 5.24.1) para Android. El elemento afectado es una funci\u00f3n desconocida del archivo AndroidManifest.xml del componente com.aftership.AfterShip. Esta manipulaci\u00f3n provoca la exportaci\u00f3n incorrecta de componentes de la aplicaci\u00f3n Android. El ataque debe ejecutarse localmente. Se ha hecho p\u00fablico el exploit y puede que sea utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n para informarle sobre esta divulgaci\u00f3n, quien respondi\u00f3: \u00abTras revisar su informe, hemos confirmado que esta vulnerabilidad existe y estamos trabajando activamente para solucionarla\u00bb."}], "id": "CVE-2025-9134", "lastModified": "2025-08-19T14:15:43.623", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}]}, "published": "2025-08-19T11:15:29.810", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md"}, {"source": "cna@vuldb.com", "url": "https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md#steps-to-reproduce"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.320514"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.320514"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.615253"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md#steps-to-reproduce"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-926"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}