Simple Contacts Pro: Improper export of content provider exposes private contacts
Simple Contacts Pro versionCode 107 (and according to the advisory also 108) declares an exported content provider without any permission requirement. Any app installed on the same Android device can query it and read private local contacts, including names, phone numbers, birthdays and anniversaries, if the hidden-contacts setting is enabled, which is the default. The provider is read-only, and no code execution or privilege escalation is claimed. The NVD record lists CVSS 9.1 with network attack vector, which does not match the local nature of this flaw described in the advisory.
Simple Mobile Tools · Simple Contacts Pro
