Lucene search

VulDBCVELIST:CVE-2024-2567

HistoryMar 17, 2024 - 9:00 p.m.

CVE-2024-2567 jurecapuder AndroidWeatherApp Backup File androidmanifest.xml backup

2024-03-1721:00:05

CWE-530

VulDB

www.cve.org

vulnerability

androidweatherapp

backup file

androidmanifest.xml

unauthorized control

physical device

public disclosure

non-supported product

code maintainer

1.4 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:M/C:P/I:N/A:N

1.8 Low

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as problematic, was found in jurecapuder AndroidWeatherApp 1.0.0 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. VDB-257070 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: The code maintainer was contacted early about this disclosure but did not respond in any way. Instead the GitHub repository got deleted after a few days. We have to assume that the product is not supported anymore.

CNA Affected

[
  {
    "vendor": "jurecapuder",
    "product": "AndroidWeatherApp",
    "versions": [
      {
        "version": "1.0.0",
        "status": "affected"
      }
    ],
    "modules": [
      "Backup File Handler"
    ]
  }
]

References

github.com/ctflearner/Android_Findings/blob/main/AndroidWeatherApp/Android_backup.md

vuldb.com/?ctiid.257070

vuldb.com/?id.257070

1.4 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:M/C:P/I:N/A:N

1.8 Low

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Related for CVELIST:CVE-2024-2567