CVE-2021-1021 — Improper Input Validation in Google Android

CWE-20 — Improper Input ValidationCWE-1021 — UI Misrepresentation / ClickjackingCWE-352 — Cross-Site Request Forgery18 documents6 sources
Severity
7.3HIGHNVD
EPSS
0.0%
top 96.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Platform Frameworks BaseLinux KernelSmartbear Swagger-ui-dist+3 more
Timeline
PublishedDec 15
Latest updateJun 19

Description

In snoozeNotificationInt of NotificationManagerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195031703

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HExploitability: 1.3 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5google/androidAndroid-12
▶NVDgoogle/android12.0
▶Androidplatform/frameworks_base12:0 — 12:2021-12-01
▶Debianlinux/linux_kernel< 5.15.15-1+1

🔴Vulnerability Details

5
OSV
CVE-2021-47615: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow For the case of IB_↗2024-06-19
▶
GHSA
Spoofing attack in swagger-ui-dist↗2022-03-12
▶
GHSA
GHSA-v8h7-57p4-wr4f: In snoozeNotificationInt of NotificationManagerService↗2021-12-16
▶
OSV
CVE-2021-1021: In snoozeNotificationInt of NotificationManagerService↗2021-12-01
▶
GHSA
Improper Restriction of Rendered UI Layers or Frames in yourls↗2021-08-30
▶

📋Vendor Advisories

12
Microsoft
Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website inside an <iFrame> HTML entry. This may be used ↗2022-03-08
▶
Red Hat
Mozilla: Iframe sandbox bypass with XSLT↗2022-01-11
▶
Red Hat
Mozilla: URL leakage when navigating while executing asynchronous function↗2021-12-07
▶
Red Hat
Mozilla: Missing fullscreen and pointer lock notification when requesting both↗2021-12-07
▶
Red Hat
Mozilla: Cursor spoofing could overlay user interface when native cursor is zoomed↗2021-12-07
▶
CVE-2021-1021 — Improper Input Validation in Google | cvebase