CVE-2021-0434

Опубликовано: 15 дек. 2021

Источник: nvd

CVSS3: 7.3

CVSS2: 6.9

EPSS Низкий

Описание

In onReceive of BluetoothPermissionRequest.java, there is a possible phishing attack allowing a malicious Bluetooth device to acquire permissions based on insufficient information presented to the user in the consent dialog. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-167403112

Ссылки

https://source.android.com/security/bulletin/2021-11-01
Vendor Advisory
https://source.android.com/security/bulletin/2021-11-01
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*

cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*

cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*

EPSS

Процентиль: 8%

0.0003

Низкий

7.3 High

CVSS3

6.9 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-c8fq-442r-8x7h