PT-2023-24205

CVE-2023-33188

Published

2023-05-27

Updated

2023-06-02

Description by

CVSS 3.1

6.3

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Omni-notes versions prior to 6.2.7

Description The Omni-notes Android app has an issue with insufficient path validation when displaying note details received through an externally-provided intent. This allows malicious applications on the same device to force Omni-notes to copy files from its internal storage to the external storage directory, making them accessible to any component with permission to read the external storage.

Recommendations Update to version 6.2.7 of Omni-notes Android to fix the issue.

Exploitability

Exploit

Fix

Researchers

Atorralba

Vendors

Affected products

Weakness enumeration

CWE-441: Unintended Proxy or Intermediary (\'Confused Deputy\')

CWE-610: Externally Controlled Reference to a Resource in Another Sphere

Related identifiers