Description (CNA)
Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. Attackers can continue deploying deleted bundles to devices by exploiting the missing app_versions.deleted filter in channel version joins.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Capgo / Capgo | affected 0 before 12.128.12; unaffected 12.128.12 |
CWE
CWE-672
References
- https://github.com/Cap-go/capgo/security/advisories/GHSA-hqq2-87cp-j83x
- https://www.vulncheck.com/advisories/capgo-deleted-bundle-selection-via-missing-deletion-filter-in-updates-endpoint
ADP enrichment
No English description supplied.