CVE-2024-21633 is a path traversal vulnerability affecting Apktool versions 2.9.1 and prior, a tool used for reverse engineering Android APK files. Attackers can manipulate resource names to write files to arbitrary locations on the system where Apktool is run, provided they have write access and either the user's name is known or the current working directory is under a user folder. This vulnerability carries a CVSS score of 7.8 HIGH, indicating a high potential for impact including confidentiality, integrity, and availability compromise, with a low attack complexity requiring user interaction. While not currently listed in CISA's KEV catalog, its high EPSS score and FAUCET Risk Score of 99/100 suggest a significant likelihood of exploitation, with a Nuclei template available for detection and community discussion indicating awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.9.2CPE matchmatch criteria | cpe:2.3:a:apktool:apktool:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.