PT-2024-27670 · Mister · Mister

Edward Warren · Published 2024-12-04 · Updated 2024-12-11 · CVE-2024-37575

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mister org.mistergroup.shouldianswer version 1.4.264

Description The issue allows any installed application, without requiring permissions, to initiate phone calls without user interaction. This is achieved by sending a crafted intent via the org.mistergroup.shouldianswer.ui.default dialer.DefaultDialerActivity component.

Recommendations For version 1.4.264, consider restricting access to the org.mistergroup.shouldianswer.ui.default dialer.DefaultDialerActivity component to prevent unauthorized phone calls until a patch is available.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2024-37575

Affected Products

Mister

References · 7

• 🔥 https://github.com/actuator/org.mistergroup.shouldianswer/blob/main/CVE-2024-37575 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37575 · Security Note
• https://github.com/actuator/org.mistergroup.shouldianswer · Note
• https://twitter.com/VulmonFeeds/status/1864481243661824225 · Twitter Post
• https://twitter.com/CVEnew/status/1864336596348060141 · Twitter Post
• https://play.google.com/store/apps/details?id=org.mistergroup.shouldianswer · Note
• https://t.me/cvedetector/12016 · Telegram Post