CVE-2023-36620 - An issue was discovered in the Boomerang Parental Control application before 13.83 for Android

Back Back to CVE browser

MEDIUM

An issue was discovered in the Boomerang Parental Control application before 13.83 for Android

Published Nov 3, 2023

4.6

MEDIUM

CVSS 3.1

EPSS 0.54%

Description

An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is used to authenticate requests to the API.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (3)

https://sec-consult.com/blog/detail/the-hidden-costs-of-parental-control-apps/
Third Party Advisory
https://seclists.org/fulldisclosure/2023/Jul/12
ExploitMailing ListThird Party Advisory
https://useboomerang.com/
Product

Link	Providers	Tags
https://sec-consult.com/blog/detail/the-hidden-costs-of-parental-control-apps/		Third Party Advisory
https://seclists.org/fulldisclosure/2023/Jul/12		ExploitMailing ListThird Party Advisory
https://useboomerang.com/		Product

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Nov 3, 2023

Updated Sep 5, 2024

Reserved Jun 25, 2023

Link CVE-2023-36620

CISA Vulnrichment

Updated Sep 5, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-36620

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-36620