CVE-2020-0454

Опубликовано: 10 нояб. 2020

Источник: nvd

CVSS3: 5.5

CVSS2: 2.1

EPSS Низкий

Описание

In callCallbackForRequest of ConnectivityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure of the current SSID with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9Android ID: A-161370134

Ссылки

https://source.android.com/security/bulletin/2020-11-01
Vendor Advisory
https://www.usenix.org/conference/usenixsecurity19/presentation/reardon
Third Party Advisory
https://www.usenix.org/system/files/sec19-reardon.pdf
Exploit
Third Party Advisory
https://source.android.com/security/bulletin/2020-11-01
Vendor Advisory
https://www.usenix.org/conference/usenixsecurity19/presentation/reardon
Third Party Advisory
https://www.usenix.org/system/files/sec19-reardon.pdf
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 7%

0.00026

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-862

Связанные уязвимости

GHSA-rrpw-6ph5-g7qx