CVE-2021-0953 — Improper Preservation of Permissions in Google Android

CWE-281 — Improper Preservation of Permissions5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 98.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform Packages Apps QuicksearchboxGoogle Android
Timeline
PublishedDec 15
Latest updateMar 14

Description

In setOnClickActivityIntent of SearchWidgetProvider.java, there is a possible way to access contacts and history bookmarks without permission due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-184046278

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5google/androidAndroid-10 Android-11 Android-12 Android-9
▶NVDgoogle/android4 versions+3
▶Androidplatform/packages_apps_quicksearchbox9:0 — 9:2021-12-01+3

🔴Vulnerability Details

2
GHSA
GHSA-qcf6-6wf2-xmxg: In setOnClickActivityIntent of SearchWidgetProvider↗2021-12-16
▶
OSV
CVE-2021-0953: In setOnClickActivityIntent of SearchWidgetProvider↗2021-12-01
▶

📋Vendor Advisories

2
CISA ICS
Siemens SIMATIC↗2024-03-14
▶
Android
CVE-2021-0953: Android Security Bulletin 2021-12-01 CVE: CVE-2021-0953 Severity: HIGH Type: EoP Affected AOSP versions: 9, 10, 11, 12 References: A-184046278↗2021-12-01
▶
CVE-2021-0953 — Improper Preservation of Permissions | cvebase