CVE-2021-0542 — Resource Exposure in Google Android

CWE-668 — Resource Exposure CWE-281 — Improper Preservation of Permissions3 documents3 sources

Severity

5.5MEDIUMNVD

EPSS

0.0%

top 96.95%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Platform Packages Apps NFC Google Android

Timeline

PublishedJun 22

Latest updateMay 24

Description

In updateNotification of BeamTransferManager.java, there is a missing permission check. This could lead to local information disclosure of paired Bluetooth addresses with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-168712890

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5google/androidAndroid-11

▶NVDgoogle/android11.0

▶Androidplatform/packages_apps_nfc11:0 — 11:2021-06-01

🔴Vulnerability Details

GHSA

GHSA-wg3j-j4rh-6353: In updateNotification of BeamTransferManager↗2022-05-24

▶

OSV

CVE-2021-0542: In updateNotification of BeamTransferManager↗2021-06-01

▶