PT-2023-24205 · Unknown · Omni-Notes

Atorralba · Published 2023-05-27 · Updated 2023-06-02 · CVE-2023-33188

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Omni-notes versions prior to 6.2.7

Description The Omni-notes Android app has an issue with insufficient path validation when displaying note details received through an externally-provided intent. This allows malicious applications on the same device to force Omni-notes to copy files from its internal storage to the external storage directory, making them accessible to any component with permission to read the external storage.

Recommendations Update to version 6.2.7 of Omni-notes Android to fix the issue.

Exploit

Fix

Weakness Enumeration

CWE-441

CWE-610

Related Identifiers

CVE-2023-33188

GHSA-G38R-4CF6-3V32

Affected Products

Omni-Notes

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33188.json · Exploit
• https://github.com/federicoiosue/Omni-Notes/security/advisories/GHSA-g38r-4cf6-3v32 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33188 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33188 · Security Note