PT-2025-2998 · Unknown · Com.Glitter.Caller.Screen

Edward Warren · Publicado 2025-01-06 · Atualizado 2025-01-07 · CVE-2024-53931

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions com.glitter.caller.screen versions 1.1 and earlier

Description The issue allows any application to place phone calls without user interaction by sending a crafted intent via the com.glitter.caller.screen.DialerActivity component. This enables unauthorized call execution.

Recommendations For versions 1.1 and earlier, as a temporary workaround, consider disabling the com.glitter.caller.screen.DialerActivity component until a patch is available. Restrict access to the com.glitter.caller.screen application to minimize the risk of exploitation. Avoid using the com.glitter.caller.screen application for making phone calls until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insecure Storage of Sensitive Information

Incorrect Permission

Enumeração de Fraquezas

CWE-922

CWE-732

Identificadores relacionados

CVE-2024-53931

Produtos afetados

Com.Glitter.Caller.Screen

Referências · 5

• 🔥 https://github.com/actuator/com.glitter.caller.screen/blob/main/CVE-2024-53931 · Exploit
• https://twitter.com/VulmonFeeds/status/1876444690431594965 · Publicação no Twitter
• https://t.me/cvedetector/14410 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2024-53931 · Nota de Segurança
• https://twitter.com/CVEnew/status/1876396468053172342 · Publicação no Twitter