What’s Vulnerable › Vulnerabilities

CVE-2021-33839

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-04 · updated 2026-06-17
• Weakness: CWE-200

Description

Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be intentionally confused with the QR code of a Private Meeting.

Affected products

• Luca-App Luca: through 1.7.4

References

• https://github.com/mame82/misc/blob/master/luca_traceIds.md
• https://luca-app.de/securityoverview/properties/objectives.html
• https://twitter.com/patrick_hennig/status/1387738281757061125
• https://youtu.be/jWyDfEB0m08
• https://github.com/mame82/misc/blob/master/luca_traceIds.md
• https://luca-app.de/securityoverview/properties/objectives.html
• https://twitter.com/patrick_hennig/status/1387738281757061125
• https://youtu.be/jWyDfEB0m08

Get alerted when CVE-2021-33839 or the next vulnerability affects your stack