CVE-2018-9459 — Path Traversal in INC Android

CWE-22 — Path Traversal5 documents5 sources

Severity

8.8HIGHNVD

EPSS

2.1%

top 16.06%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google INC Android Google Android

Timeline

PublishedNov 6

Latest updateMay 14

Description

In Attachment of Attachment.java and getFilePath of EmlAttachmentProvider.java, there is a possible Elevation of Privilege due to a path traversal error. This could lead to a remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-66230183.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDgoogle/android7 versions+6

▶CVEListV5google_inc/androidAndroid-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1

🔴Vulnerability Details

GHSA

GHSA-v7m6-5cj6-97g7: In Attachment of Attachment↗2022-05-14

▶

CVEList

CVE-2018-9459: In Attachment of Attachment↗2018-11-06

▶

📋Vendor Advisories

Android

CVE-2018-9459: Android Security Bulletin 2018-08-01 CVE: CVE-2018-9459 Severity: HIGH Type: EoP Affected AOSP versions: 6↗2018-08-01

▶

💬Community

Bugzilla

CVE-2018-11751 puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL↗2020-01-06

▶