PT-2025-23311 · Unknown · Com.Pri.Applock

Szymon Chadam · Published 2025-05-30 · Updated 2025-06-13 · CVE-2024-13916

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions com.pri.applock version 13 (version code: 33) com.pri.applock (affected versions not specified)

Description The application "com.pri.applock" allows users to encrypt applications using a PIN code or biometric data. However, the "com.android.providers.settings.fingerprint.PriFpShareProvider" content provider's public method query() can be exploited by malicious applications to exfiltrate the PIN code without requiring any Android system permissions.

Recommendations For version 13 (version code: 33), consider restricting access to the query() method of the "com.android.providers.settings.fingerprint.PriFpShareProvider" content provider to prevent PIN code exfiltration. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-497

CWE-926

Related Identifiers

CVE-2024-13916

Affected Products

Com.Pri.Applock

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-13916 · Security Note
• https://t.me/cvenotify/125219 · Telegram Post
• https://t.me/cvetracker/25027 · Telegram Post
• https://twitter.com/CVEnew/status/1928475333646278802 · Twitter Post
• https://cert.pl/en/posts/2025/05/CVE-2024-13915 · Note
• https://t.me/purp_sec/727 · Telegram Post
• https://twitter.com/PreEmptive/status/1933525012796911622 · Twitter Post
• https://t.me/cvenotify/125218 · Telegram Post
• https://t.me/cvetracker/25028 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1928541318159974853 · Twitter Post
• https://twitter.com/instantvidget/status/1929873669762813997 · Twitter Post