CVE-2021-33838

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-203

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mame82/misc/blob/master/luca_traceIds.mdThird Party Advisory
https://luca-app.de/securityoverview/properties/objectives.htmlVendor Advisory
https://www.ccc.de/de/updates/2021/luca-app-ccc-fordert-bundesnotbremseThird Party Advisory
https://www.youtube.com/playlist?list=PLKuX6iczGb3kuDsm2RFgbmRkTugkR9-UEExploit, Third Party Advisory
https://github.com/mame82/misc/blob/master/luca_traceIds.mdThird Party Advisory
https://luca-app.de/securityoverview/properties/objectives.htmlVendor Advisory
https://www.ccc.de/de/updates/2021/luca-app-ccc-fordert-bundesnotbremseThird Party Advisory
https://www.youtube.com/playlist?list=PLKuX6iczGb3kuDsm2RFgbmRkTugkR9-UEExploit, Third Party Advisory

Timeline

Published: Jun 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-338397.5Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Publi CVE-2021-33845.3A vulnerability in Stormshield Network Security could allow an attacker to trigger a protection related to ARP/NDP tables management, which CVE-2021-338407.5The server in Luca through 1.1.14 allows remote attackers to cause a denial of service (insertion of many fake records related to COVID-19) CVE-2021-338419.8SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into CVE-2021-338428.8Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform CVE-2021-338435.3Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a default configuration page accessible without authentication. An attacker may use this CVE-2021-338445.5A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file. An attacker with a crafted wav CVE-2021-338455.3The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Ent CVE-2021-338467.2Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 issues authentication tokens to authenticated users that are si CVE-2021-338477.8Improper buffer restrictions in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 CVE-2021-338486.1Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 is vulnerable to reflected cross-site scripting attacks. An att CVE-2021-338495.4A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a tru