In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:42
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://android.googlesource.com/platform/frameworks/base/+/57946e2bb73850e817b3c01fa5350d705e178e39 - Patch | |
| References | () https://source.android.com/security/bulletin/2023-07-01 - Patch, Vendor Advisory |
25 Jul 2023, 14:48
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.3 |
| First Time |
Google
Google android |
|
| CWE | CWE-20 | |
| CPE | cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:13.1:*:*:*:*:*:*:* |
|
| References | (MISC) https://source.android.com/security/bulletin/2023-07-01 - Patch, Vendor Advisory | |
| References | (MISC) https://android.googlesource.com/platform/frameworks/base/+/57946e2bb73850e817b3c01fa5350d705e178e39 - Patch |
13 Jul 2023, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-13 00:15
Updated : 2024-11-21 07:42
NVD link : CVE-2023-21251
Mitre link : CVE-2023-21251
CVE.ORG link : CVE-2023-21251
JSON object : View
Products Affected
- android
CWE
CWE-20
Improper Input Validation