DerScanner
Home / Vulnerability Database / Android : Unsafe SMS handling
Android

Android : Unsafe SMS handling

Classification

OWASP Mobile Top 10 2014
M4-Unintended Data LeakageM8-Security Decisions Via Untrusted Inputs
OWASP Mobile Top 10 2016
M3-Insecure Communication
OWASP MASVS
V6: 6.1.(L1/L2/L1+R/L2+R)
CWE
CWE-250
CWE/SANS Top 25 2011
CWE-250

Overview

This application requests SMS permission. Incorrect processing of SMS messages may violate user privacy.

The application must request SMS permission, only if it is necessary for its operation. Malicious software often uses this permission in order to deceive users.

References

  1. SmsManager - developer.android.com
  2. OWASP Top 10 2013-A6-Sensitive Data Exposure
  3. CWE-250: Execution with Unnecessary Privileges
MEDIUM

DerScanner Severity Score

Do you want to fix Android : Unsafe SMS handling in your application?

See also

Android

Android : Debug mode on

Android

Android : Error handling: generic exception

Android

Android : HTTP usage