PT-2025-12019 · Inure+1 · Inure+1

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-0245

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions hamza417/inure versions prior to build97

Description A misconfiguration in the AndroidManifest.xml file allows for task hijacking, permitting malicious applications to inherit permissions of the vulnerable app. This could lead to the exposure of sensitive information. An attacker can create a malicious app that hijacks the legitimate Inure app, intercepting and stealing sensitive information when installed on the victim's device. This issue affects all Android versions before Android 11.

Recommendations For versions prior to build97, update to build97 or later to resolve the issue. As a temporary workaround, consider restricting the installation of untrusted applications to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Information Disclosure

Weakness Enumeration

CWE-276

CWE-200

Related Identifiers

CVE-2024-0245

Affected Products

Android

Inure

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-0245 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0245 · Vendor Advisory
• https://github.com/hamza417/inure/commit/a0c3e68b0542bcd7007c93618e0d50a5331de061 · Note
• https://t.me/cvenotify/115443 · Telegram Post
• https://twitter.com/CVEnew/status/1902671136892301336 · Twitter Post
• https://huntr.com/bounties/2108644e-9e54-4236-932d-f204fc68b607 · Note