Описание
In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Ссылки
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
3.3 Low
CVSS3
Дефекты
Связанные уязвимости
In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Уязвимость метода updateProvidersWhenServiceRemoved класса CredentialManagerService.java компонента Framework операционных систем Android, позволяющая нарушителю раскрыть защищаемую информацию
EPSS
3.3 Low
CVSS3