CVE-2011-1717: SQL Injection

Published Apr 18, 2011

Updated

Skype for Android stores sensitive user data without encryption in sqlite3 databases that have weak permissions, which allows local applications to read user IDs, contacts, phone numbers, date of birth, instant message logs, and other private information.

Affected Software

1 affected component

skype Skype for Android

Event History

Apr 18, 2011

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-1717?

CVE-2011-1717 is considered a high severity vulnerability due to improper handling of sensitive user data.

How do I fix CVE-2011-1717?

To fix CVE-2011-1717, update Skype for Android to the latest version where the vulnerability has been addressed.

What types of data are exposed in CVE-2011-1717?

CVE-2011-1717 exposes sensitive user data such as user IDs, contacts, phone numbers, and instant message logs.

Who is affected by CVE-2011-1717?

Users of Skype for Android are affected by CVE-2011-1717 due to the lack of data encryption.

Is there a workaround for CVE-2011-1717?

There is no effective workaround for CVE-2011-1717 other than updating to the patched version of Skype for Android.