Input Validation (OWASP Mobile M4)
Unsafe deserialization of untrusted data, and Intent extras trusted without validation leading to privilege escalation.
5 vulnerabilities. OWASP Mobile: M4
| Vulnerability | ID | Platform | Difficulty | OWASP | MASVS | MASWE | MASTG (v2) | CWE |
|---|---|---|---|---|---|---|---|---|
| Deep Link Regex DoS (ReDoS) | deeplink_regex_dos | AndroidiOS | MEDIUM | M4 | MASVS-CODE-4 | MASWE-0050 | - | CWE-1333CWE-400CWE-20 |
| Unsafe Media / Image Decoding | unsafe_media_decoding | AndroidiOS | MEDIUM | M4 | MASVS-CODE-4MASVS-PLATFORM-2 | MASWE-0050 | - | CWE-20CWE-1284CWE-409 |
| Unvalidated Intent Extras | unvalidated_intent_extras | Android | MEDIUM | M4 | MASVS-PLATFORM-1MASVS-CODE-4 | MASWE-0050 | MASTG-TEST-0375 | CWE-20CWE-926 |
| Protected-Data Access via Input-Validation Confusion | protected_data_access_via_input_validation | AndroidiOS | HARD | M4 | MASVS-CODE-4MASVS-AUTH-1 | MASWE-0050 | - | CWE-20CWE-863CWE-180 |
| Unsafe Deserialization | unsafe_deserialization | AndroidiOS | HARD | M4 | MASVS-CODE-4 | MASWE-0050 | MASTG-TEST-0337MASTG-TEST-0386 | CWE-502 |