Read the docs
TI-2024-00220 Aliases CVE-2024-0245GHSA-v67x-89x7-mh47

Task Hijacking in hamza417/inure

Priority MEDIUM 58CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

A misconfiguration in the AndroidManifest.xml file in hamza417/inure before build97 allows for task hijacking. This vulnerability permits malicious applications to inherit permissions of the vulnerable app, potentially leading to the exposure of sensitive information. An attacker can create a malicious app that hijacks the legitimate Inure app, intercepting and stealing sensitive information when installed on the victim's device. This issue affects all Android versions before Android 11.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix Fixed hamza417/inure (hamza417): build97

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hamza417hamza417/inurebefore build97build97Patch availableCNA
  • hamza417/inure Vendorhamza417 Affected before build97 Fixed in build97 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:hamza417:inure:*:*:*:*:*:*:*:*——hamza417
  • cpe:2.3:a:hamza417:inure:*:*:*:*:*:*:*:* Versions — — ·hamza417

Remediation

  • Fix · CNA hamza417/inure (hamza417) Fixed in build97

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-0245
  2. 2026-10-03 Alias added: GHSA-v67x-89x7-mh47

References

Other 2

  • TI-2023-04093 Improper Input Validation in hamza417/inure CVSS 3.1MEDIUM 5.5
  • TI-2023-04092 Missing Authorization in hamza417/inure CVSS 3.1MEDIUM 6.1
  • TI-2023-04894 Missing Authorization in hamza417/inure CVSS 3.1MEDIUM 5.5
  • TI-2023-05397 Missing Authorization in hamza417/inure CVSS 3.1LOW 3.3
  • TI-2023-04490 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure CVSS 3.1HIGH 7.5
  • TI-2023-04491 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences