PT-2023-24205 · Unknown · Omni-Notes

Atorralba · Publicado 2023-05-27 · Atualizado 2023-06-02 · CVE-2023-33188

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Omni-notes versions prior to 6.2.7

Description The Omni-notes Android app has an issue with insufficient path validation when displaying note details received through an externally-provided intent. This allows malicious applications on the same device to force Omni-notes to copy files from its internal storage to the external storage directory, making them accessible to any component with permission to read the external storage.

Recommendations Update to version 6.2.7 of Omni-notes Android to fix the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-441

CWE-610

Identificadores relacionados

CVE-2023-33188

GHSA-G38R-4CF6-3V32

Produtos afetados

Omni-Notes

Referências · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33188.json · Exploit
• https://github.com/federicoiosue/Omni-Notes/security/advisories/GHSA-g38r-4cf6-3v32 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-33188 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-33188 · Nota de Segurança