CVE-2021-33057
First published: Tue Jul 26 2022(Updated: )
The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the device's physical location. An attacker can use qq.createMapContext to create a MapContext object, use MapContext.moveToLocation to move the center of the map to the device's location, and use MapContext.getCenterLocation to get the latitude and longitude of the current map center.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tencent Qq | =8.7.1 | |
| Tencent Qq | =8.7.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-33057?
CVE-2021-33057 is a vulnerability in the QQ application 8.7.1 for Android and iOS that allows an attacker to bypass location permission requirements and determine the device's physical location.
What is the severity of CVE-2021-33057?
CVE-2021-33057 has a severity value of 7.5, which is classified as high.
How does CVE-2021-33057 affect the QQ application?
CVE-2021-33057 affects the QQ application 8.7.1 for Android and iOS by allowing an attacker to determine the device's physical location without proper permission enforcement.
How can an attacker exploit CVE-2021-33057?
An attacker can exploit CVE-2021-33057 by using qq.createMapContext to create a MapContext object and then using MapContext.moveToLocation to move the device to a specific location.
How can I mitigate CVE-2021-33057?
To mitigate CVE-2021-33057, update the QQ application to the latest version, which includes the necessary permission enforcement.
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/author
- agent/type
- agent/tags
- agent/event
- agent/references
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/tencent
- canonical/tencent qq
- version/tencent qq/8.7.1