CVE-2025-21615

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-21615
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21615.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21615
Aliases
  • GHSA-pwpm-x58v-px5c
Published
2025-01-06T16:25:27.758Z
Modified
2025-12-02T02:33:51.025910Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
AAT allows data exfiltration by other apps installed on the same device
Details

AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21615.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

Git / github.com/bailuk/aat

Affected ranges

Type
GIT
Repo
https://github.com/bailuk/aat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
122fa650877f276e20eb958f77c2d4b06dc27b3b
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.26"
        }
    ]
}

Affected versions

v0.*

v0.5-alpha
v0.6-alpha
v0.7-alpha
v0.8-alpha
v0.9-alpha

v1.*

v1.0-beta
v1.1-beta
v1.10-beta
v1.11-beta
v1.12-beta
v1.13
v1.14
v1.14.1
v1.15
v1.15.1
v1.16
v1.16.1
v1.17
v1.18
v1.19
v1.2-beta
v1.20
v1.21
v1.22
v1.23
v1.24
v1.24.1
v1.25
v1.25.1
v1.25.2
v1.3-beta
v1.3.1-beta
v1.4-beta
v1.5-beta
v1.6-beta
v1.7-beta
v1.8-beta
v1.9-beta