CVE-2023-36620

Опубликовано: 03 нояб. 2023

Источник: nvd

CVSS3: 4.6

EPSS Низкий

Описание

An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is used to authenticate requests to the API.

Ссылки

https://sec-consult.com/blog/detail/the-hidden-costs-of-parental-control-apps/
Third Party Advisory
https://seclists.org/fulldisclosure/2023/Jul/12
Exploit
Mailing List
Third Party Advisory
https://useboomerang.com/
Product
https://sec-consult.com/blog/detail/the-hidden-costs-of-parental-control-apps/
Third Party Advisory
https://seclists.org/fulldisclosure/2023/Jul/12
Exploit
Mailing List
Third Party Advisory
https://useboomerang.com/
Product

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:nationaledtech:boomerang:*:*:*:*:*:android:*:*

Версия до 13.83 (исключая)

EPSS

Процентиль: 22%

0.00071

Низкий

4.6 Medium

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-284

Связанные уязвимости

GHSA-jhc6-x647-xmhf