nanopathi/packages_apps_Settings_CVE-2021-0586

CVE-2021-0591 (High) detected in multiple libraries

mend-bolt-for-github opened this issue · 0 comments

mend-bolt-for-github commented

CVE-2021-0591 - High Severity Vulnerability

Vulnerable Libraries - Settingsandroid-10.0.0_r33, Settingsandroid-10.0.0_r33, Settingsandroid-10.0.0_r33

Vulnerability Details

In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcast receivers due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-179386960

Publish Date: 2021-08-17

URL: CVE-2021-0591

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here