PT-2022-24917 · Tasks.Org · Tasks.Org

Abaker + 1 · Published 2022-10-25 · Updated 2022-10-28 · CVE-2022-39349

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tasks.org versions prior to 12.7.1 Tasks.org versions prior to 13.0.1

Description The Tasks.org Android app has a sensitive information disclosure issue. The app's ShareLinkActivity.kt activity handles "share" intents and may copy files from internal storage to external storage if the file paths in the intents are not validated. This allows malicious applications on the same device to access sensitive information, including notes, preferences, and encrypted CalDav integration credentials.

Recommendations For versions prior to 12.7.1, update to version 12.7.1 or later. For versions prior to 13.0.1, update to version 13.0.1 or later.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

CWE-441

Related Identifiers

CVE-2022-39349

GHSA-8X58-CG74-8JG8

Affected Products

Tasks.Org

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39349.json · Exploit
• https://github.com/tasks/tasks/security/advisories/GHSA-8x58-cg74-8jg8 · Patch
• https://github.com/tasks/tasks/commit/23bf69d3f44b07e4bc62ea107f72103239f5d942 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39349 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39349 · Vendor Advisory