CVE-2020-0422 — Insecure Storage of Sensitive Information in Google Android

CWE-922 — Insecure Storage of Sensitive Information5 documents5 sources

Severity

3.3LOWNVD

EPSS

0.0%

top 98.00%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Platform Packages Apps Contacts Google Android

Timeline

PublishedOct 14

Latest updateMay 24

Description

In constructImportFailureNotification of NotificationImportExportListener.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local information disclosure of contact data with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-161718556

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5google/androidAndroid-8.1 Android-9 Android-10 Android-11 Android-8.0

▶NVDgoogle/android5 versions+4

▶Androidplatform/packages_apps_contacts8.0:0 — 8.0:2020-10-01+4

Patches

Patch: source.android.com ↗Patch: source.android.com ↗

🔴Vulnerability Details

GHSA

GHSA-j42v-w6hm-cc4x: In constructImportFailureNotification of NotificationImportExportListener↗2022-05-24

▶

CVEList

CVE-2020-0422: In constructImportFailureNotification of NotificationImportExportListener↗2020-10-14

▶

OSV

CVE-2020-0422: In constructImportFailureNotification of NotificationImportExportListener↗2020-10-01

▶

📋Vendor Advisories

Android

CVE-2020-0422: Android Security Bulletin 2020-10-01 CVE: CVE-2020-0422 Severity: HIGH Type: ID Affected AOSP versions: 8↗2020-10-01

▶