OpenTracks: Insecure permissions allow injection of tracking data
The io.file.importer.ImportActivity component of OpenTracks versionCode 6751 has insecure permissions. An attacker can inject crafted tracking data into the location database of the app via a crafted SEND message. The records were reported with CVSS 9.1 by the CVE data, but the scoring and attack vector are not confirmed by other sources, and the advisory text could not be read directly.
OpenTracks Team · OpenTracks
