PT-2023-24205

CVE-2023-33188

Publicado

2023-05-27

Atualizado

2023-06-02

Descrição por

CVSS 3.1

6.3

Média

MétricasAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Omni-notes versions prior to 6.2.7

Description The Omni-notes Android app has an issue with insufficient path validation when displaying note details received through an externally-provided intent. This allows malicious applications on the same device to force Omni-notes to copy files from its internal storage to the external storage directory, making them accessible to any component with permission to read the external storage.

Recommendations Update to version 6.2.7 of Omni-notes Android to fix the issue.

Explorabilidade

Exploit

Correção

Pesquisadores

Atorralba

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-441: Unintended Proxy or Intermediary (\'Confused Deputy\')

CWE-610: Externally Controlled Reference to a Resource in Another Sphere

Identificadores relacionados