CVE-2023-21272

Опубликовано: 14 авг. 2023

Источник: nvd

CVSS3: 7.8

EPSS Низкий

Описание

In readFrom of Uri.java, there is a possible bad URI permission grant due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Ссылки

https://android.googlesource.com/platform/frameworks/base/+/4dea696369a309cf39daa3e94fec7156c290a9c2
Broken Link
https://source.android.com/security/bulletin/2023-08-01
Patch
Vendor Advisory
https://android.googlesource.com/platform/frameworks/base/+/4dea696369a309cf39daa3e94fec7156c290a9c2
Broken Link
https://source.android.com/security/bulletin/2023-08-01
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:google:android:11.0:-:*:*:*:*:*:*

cpe:2.3:o:google:android:12.0:-:*:*:*:*:*:*

cpe:2.3:o:google:android:12.1:-:*:*:*:*:*:*

EPSS

Процентиль: 2%

0.00014

Низкий

7.8 High

CVSS3

Дефекты

CWE-20

CWE-269

Связанные уязвимости

GHSA-qwg2-w2jv-5hp7