PT-2021-10767 · Tasks · Tasks

Published 2021-02-22 · Updated 2021-02-27 · CVE-2020-22475

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tasks application version prior to 9.7.3

Description The issue is related to insecure permissions in the Tasks application. Specifically, the VoiceCommandActivity application component allows arbitrary applications on a device to add tasks with no restrictions.

Recommendations For versions prior to 9.7.3, update to version 9.7.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the VoiceCommandActivity component to minimize the risk of exploitation.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-22475

Affected Products

Tasks

References · 5

• 🔥 https://lyhinslab.org/index.php/2020/07/18/how-the-white-box-hacking-works-ok-google-i-wanna-pwn-this-app · Exploit
• 🔥 https://exploit-db.com/exploits/49563 · Exploit
• https://osv.dev/vulnerability/CVE-2020-22475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-22475 · Security Note
• https://t.me/cvenotify/10596 · Telegram Post