CVE-2022-20081 — Improper Certificate Validation in Google Android

CWE-295 — Improper Certificate Validation4 documents4 sources
Severity
5.9MEDIUMNVD
EPSS
0.2%
top 63.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Android
Timeline
PublishedApr 11
Latest updateApr 12

Description

In A-GPS, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06461919; Issue ID: ALPS06461919.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages2 packages

▶NVDgoogle/android10.0, 11.0, 12.0+2

🔴Vulnerability Details

2
GHSA
GHSA-g5xx-f9cv-w25h: In A-GPS, there is a possible man in the middle attack due to improper certificate validation↗2022-04-12
▶
OSV
CVE-2022-20081: In A-GPS, there is a possible man in the middle attack due to improper certificate validation↗2022-04-01
▶

📋Vendor Advisories

1
Android
CVE-2022-20081: A-GPS↗2022-04-01
▶
CVE-2022-20081 — Improper Certificate Validation | cvebase