nanopathi/packages_apps_Settings_CVE-2021-0586

CVE-2021-0593 (High) detected in multiple libraries

mend-bolt-for-github opened this issue · 0 comments

mend-bolt-for-github commented

CVE-2021-0593 - High Severity Vulnerability

Vulnerable Libraries - Settingsandroid-10.0.0_r33, Settingsandroid-10.0.0_r33, Settingsandroid-10.0.0_r33

Vulnerability Details

In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiver due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-179386068

Publish Date: 2021-08-17

URL: CVE-2021-0593

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here