In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2025-0082 |
Exploitation
To exploit this vulnerability, an attacker must interact with the affected application in a way that triggers the functions in StatusHint.java and TelecomServiceImpl.java. This could involve manipulating user inputs or accessing shared resources that lead to the unintended disclosure of images across user boundaries.
Affected Products
- StatusHint.java – A component that may inadvertently expose user images due to improper access controls.
- TelecomServiceImpl.java – A service implementation that could allow for cross-user image disclosure under certain conditions.
Mitigation
To mitigate this vulnerability, it is recommended to implement stricter access controls and validation checks within the affected functions. Additionally, users should be advised to update their applications to the latest versions that address this issue.