CVE-2021-0523 (High) detected in Settingsandroid-10.0.0_r33
mend-bolt-for-github opened this issue · 2 comments
CVE-2021-0523 - High Severity Vulnerability
Vulnerable Library - Settingsandroid-10.0.0_r33
Library home page: https://android.googlesource.com/platform/packages/apps/Settings
Found in HEAD commit: a353664da30a0b95adee9281a4af5c1d5cacc22e
Found in base branch: master
Vulnerability Details
In onCreate of WifiScanModeActivity.java, there is a possible way to enable Wi-Fi scanning without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-174047492
Publish Date: 2021-06-21
URL: CVE-2021-0523
CVSS 3 Score Details (7.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://source.android.com/security/bulletin/2021-06-01
Release Date: 2021-06-21
Fix Resolution: android-11.0.0_r38
Step up your Open Source Security Game with Mend here
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.