exploitDog

CVE-2023-21110

Опубликовано: 15 мая 2023

Источник: nvd

CVSS3: 7.8

EPSS Низкий

Описание

In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-258422365

Ссылки

https://source.android.com/security/bulletin/2023-05-01
Patch
Vendor Advisory
https://source.android.com/security/bulletin/2023-05-01
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*

cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*

cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*

cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*

EPSS

Процентиль: 4%

0.00019

Низкий

7.8 High

CVSS3

Дефекты

CWE-400

CWE-770

Связанные уязвимости

GHSA-qfvr-c3w2-x3h7

CVSS3: 7.8

github

больше 2 лет назад

In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-258422365

EPSS

Процентиль: 4%

0.00019

Низкий

7.8 High

CVSS3

Дефекты

CWE-400

CWE-770