CVE-2021-33057

The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the device's physical location. An attacker can use qq.createMapContext to create a MapContext object, use MapContext.moveToLocation to move the center of the map to the device's location, and use MapContext.getCenterLocation to get the latitude and longitude of the current map center.

• CWE-862

• https://arxiv.org/pdf/2205.15202.pdfTechnical Description, Third Party Advisory
• https://github.com/BESTICSP/Vulnerabilities-Related-to-Mini-Programs-Permissions/blob/main/QQ%20applet%20location%20permission%20vulnerability%20report.pdfExploit, Third Party Advisory
• https://tencent.comVendor Advisory
• https://arxiv.org/pdf/2205.15202.pdfTechnical Description, Third Party Advisory
• https://github.com/BESTICSP/Vulnerabilities-Related-to-Mini-Programs-Permissions/blob/main/QQ%20applet%20location%20permission%20vulnerability%20report.pdfExploit, Third Party Advisory
• https://tencent.comVendor Advisory

Published

Jul 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33045The identity authentication bypass vulnerability found in so…9.8
• CVE-2021-33046Some Dahua products have access control vulnerability in the…9.8
• CVE-2021-3305Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discov…7.8
• CVE-2021-33054SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does …7.5
• CVE-2021-33055Zoho ManageEngine ADSelfService Plus through 6102 allows una…9.8
• CVE-2021-33056Belledonne Belle-sip before 4.5.20, as used in Linphone and …7.5
• CVE-2021-33058Improper access control in the installer Intel(R)Administrat…7.8
• CVE-2021-33059Improper input validation in the Intel(R) Administrative Too…6.7
• CVE-2021-33060Out-of-bounds write in the BIOS firmware for some Intel(R) P…7.8
• CVE-2021-33061Insufficient control flow management for the Intel(R) 82599 …5.5
• CVE-2021-33062Incorrect default permissions in the software installer for …7.8
• CVE-2021-33063Uncontrolled search path in the Intel(R) RealSense(TM) D400 …7.8