CWE-927: Use of Implicit Intent for Sensitive Communication
Description
The Android application uses an implicit intent for transmitting sensitive data to other applications.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- Confidentiality
Read Application Data
Other applications, possibly untrusted, can read the data that is offered through the Intent.
- Integrity
Varies by Context
The application may handle responses from untrusted applications on the device, which could cause it to perform unexpected or unauthorized actions.
Potential mitigations
- Implementation
If the application only requires communication with its own components, then the destination is always known, and an explicit intent could be used.
Related weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.