CVE-2021-0552 — Incorrect Permission Assignment in Google Android

CWE-732 — Incorrect Permission AssignmentCWE-668 — Resource ExposureCWE-444 — HTTP Request Smuggling5 documents5 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 96.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform Packages Apps SettingsGoogle Android
Timeline
PublishedJun 22
Latest updateMay 24

Description

In getEndItemSliceAction of MediaOutputSlice.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-175124820

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5google/androidAndroid-11
▶NVDgoogle/android11.0
▶Androidplatform/packages_apps_settings11:0 — 11:2021-06-01

🔴Vulnerability Details

3
GHSA
GHSA-rrxp-xq3m-923g: In getEndItemSliceAction of MediaOutputSlice↗2022-05-24
▶
CVEList
CVE-2021-0552: In getEndItemSliceAction of MediaOutputSlice↗2021-06-22
▶
OSV
CVE-2021-0552: In getEndItemSliceAction of MediaOutputSlice↗2021-06-01
▶

📋Vendor Advisories

1
Red Hat
origin-aggregated-logging/elasticsearch: Incomplete fix for netty-codec-http CVE-2021-21409↗2022-02-28
▶
CVE-2021-0552 — Incorrect Permission Assignment | cvebase