CVE-2023-21246

Опубликовано: 13 июл. 2023

Источник: nvd

CVSS3: 3.3

EPSS Низкий

Описание

In ShortcutInfo of ShortcutInfo.java, there is a possible way for an app to retain notification listening access due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Ссылки

https://android.googlesource.com/platform/frameworks/base/+/fc1b9998ca8a9fceba47d67fd9ea9b45705b53e0
Patch
https://source.android.com/security/bulletin/2023-07-01
Patch
Vendor Advisory
https://android.googlesource.com/platform/frameworks/base/+/fc1b9998ca8a9fceba47d67fd9ea9b45705b53e0
Patch
https://source.android.com/security/bulletin/2023-07-01
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*

cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*

cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*

cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*

EPSS

Процентиль: 3%

0.00016

Низкий

3.3 Low

CVSS3

Дефекты

CWE-754

CWE-273

Связанные уязвимости

GHSA-jmwv-xww6-6hcv