Unzureichende Schutzmechanismen im Health Module können zu einer teilweisen Offenlegung von Informationen führen.

The Information Disclosure vulnerability in the Health Module allows an attacker to potentially access sensitive data. While the description specifies 'partial information disclosure,' the exact nature of the data exposed is not detailed. Depending on the data handled by the Health Module, this could range from benign metadata to personally identifiable information (PII) or even health-related data. The impact is amplified if the module is integrated with other systems, as the attacker could potentially leverage the disclosed information for further attacks, such as identity theft or social engineering. The blast radius depends entirely on the data the module processes and stores.

Android applications utilizing the Health Module prior to version 5.3.0.0 are at risk. This includes applications that directly integrate the module or rely on its functionality for health-related data processing. Shared hosting environments where multiple applications share the Health Module are particularly vulnerable.

1. 2026-02-27Disclosure

   disclosure

1. Reserviert2026-02-06
2. Veröffentlicht2026-02-27
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-15567 is to upgrade the Health Module to version 5.3.0.0 or later. If upgrading immediately is not feasible, consider implementing temporary workarounds to limit data exposure. This might involve restricting access to the Health Module's data, implementing stricter input validation, or disabling potentially vulnerable features. Monitor logs for any unusual access patterns or data exfiltration attempts. After upgrading, confirm the fix by verifying that the module no longer exposes sensitive information through the previously vulnerable pathways.