AppML neutriNote CE: Insecure permissions in autosave allow file writes
neutriNote CE for Android, versionCode 1387, has insecure permissions in its autosave component. According to the linked third-party advisory, an app without permissions could launch an exported activity and make the app write attacker-chosen content to a file URI the app can access. The CVE record states that unauthorized attackers can write arbitrary files, but the conditions and the real attack path are not confirmed. The advisory's CVSS attack vector (network) is disputed, and the sources do not show that the flaw is reachable remotely.
AppML · neutriNote CE
