Vulnerabilities > CVE-2021-33057 - Missing Authorization vulnerability in Tencent QQ 8.7.1

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
tencent
CWE-862
NVD
Published: 2022-07-26
Updated: 2024-11-21

Summary

The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the device's physical location. An attacker can use qq.createMapContext to create a MapContext object, use MapContext.moveToLocation to move the center of the map to the device's location, and use MapContext.getCenterLocation to get the latitude and longitude of the current map center.

Vulnerable Configurations

Part Description Count
Application
Tencent
2

Common Weakness Enumeration (CWE)

References