Health Moduleにおける不十分な保護メカニズムにより、部分的な情報漏洩が発生する可能性があります。

The Information Disclosure vulnerability in the Health Module allows an attacker to potentially access sensitive data. While the description specifies 'partial information disclosure,' the exact nature of the data exposed is not detailed. Depending on the data handled by the Health Module, this could range from benign metadata to personally identifiable information (PII) or even health-related data. The impact is amplified if the module is integrated with other systems, as the attacker could potentially leverage the disclosed information for further attacks, such as identity theft or social engineering. The blast radius depends entirely on the data the module processes and stores.

Android applications utilizing the Health Module prior to version 5.3.0.0 are at risk. This includes applications that directly integrate the module or rely on its functionality for health-related data processing. Shared hosting environments where multiple applications share the Health Module are particularly vulnerable.

1. 2026-02-27Disclosure

   disclosure

1. 予約済み2026-02-06
2. 公開日2026-02-27
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-15567 is to upgrade the Health Module to version 5.3.0.0 or later. If upgrading immediately is not feasible, consider implementing temporary workarounds to limit data exposure. This might involve restricting access to the Health Module's data, implementing stricter input validation, or disabling potentially vulnerable features. Monitor logs for any unusual access patterns or data exfiltration attempts. After upgrading, confirm the fix by verifying that the module no longer exposes sensitive information through the previously vulnerable pathways.