CVE-2024-0245: medium-severity vulnerability in hamza417/inure
Task Hijacking in hamza417/inure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.5epss 0.2%
A misconfiguration in the AndroidManifest.xml file in hamza417/inure before build97 allows for task hijacking. This vulnerability permits malicious applications to inherit permissions of the vulnerable app, potentially leading to the exposure of sensitive information. An attacker can create a malicious app that hijacks the legitimate Inure app, intercepting and stealing sensitive information when installed on the victim's device. This issue affects all Android versions before Android 11.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected products
hamza417 · hamza417/inureRelated CVEs — hamza417/inure
In the same product, most dangerous first.
CVE-2023-4877MEDIUMExposure of Sensitive Information to an Unauthorized Actor in hamza417/inureEPSS 0.4%CVE-2023-4435HIGHImproper Input Validation in hamza417/inureEPSS 0.4%CVE-2023-4876HIGHExposure of Sensitive Information to an Unauthorized Actor in hamza417/inureEPSS 0.4%CVE-2023-4434MEDIUMMissing Authorization in hamza417/inureEPSS 0.3%CVE-2023-5321MEDIUMMissing Authorization in hamza417/inureEPSS 0.3%CVE-2023-5862MEDIUMMissing Authorization in hamza417/inureEPSS 0.3%