What’s Vulnerable › Vulnerabilities
CVE-2023-36612
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2023-06-25 · updated 2026-06-17
- Weakness: CWE-22
Description
Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a malicious intent, the attacker may redirect the server's responses (containing sensitive information) to third-party applications by using a custom-crafted deeplink scheme.
Affected products
- Basecamp: before 4.2.1 — fixed in 4.2.1
How to fix
Upgrade to a fixed version: Basecamp 4.2.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2023-36612 or the next vulnerability affects your stack