CVE-2022-20350
published 2022-08-10CVE-2022-20350: In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to trick the victim to grant notification access to the wrong app due to…
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.10%
0.8th percentile
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to trick the victim to grant notification access to the wrong app due to improper input validation. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-228178437
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| platform | frameworks_base | >= 10:0 < 10:2022-08-01 | 10:2022-08-01 |
| platform | frameworks_base | >= 11:0 < 11:2022-08-01 | 11:2022-08-01 |
| platform | frameworks_base | >= 12:0 < 12:2022-08-01 | 12:2022-08-01 |
| platform | frameworks_base | >= 12L:0 < 12L:2022-08-01 | 12L:2022-08-01 |
| platform | packages_apps_car_settings | >= 12L:0 < 12L:2022-08-01 | 12L:2022-08-01 |
| platform | packages_apps_settings | >= 10:0 < 10:2022-08-01 | 10:2022-08-01 |
| platform | packages_apps_settings | >= 11:0 < 11:2022-08-01 | 11:2022-08-01 |
| platform | packages_apps_settings | >= 12:0 < 12:2022-08-01 | 12:2022-08-01 |
| platform | packages_apps_settings | >= 12L:0 < 12L:2022-08-01 | 12L:2022-08-01 |
| platform | packages_services_car | >= 10:0 < 10:2022-08-01 | 10:2022-08-01 |
| platform | packages_services_car | >= 11:0 < 11:2022-08-01 | 11:2022-08-01 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Android
CVE-2022-20350: Android Security Bulletin 2022-08-01
CVE: CVE-2022-20350
Severity: HIGH
Type: ID
Affected AOSP versions: 10, 11, 12, 12L
References: A-228178437
[2]
[
vendor_android·2022-08-01·CVSS 5.5
CVE-2022-20350 [MEDIUM] CVE-2022-20350: Android Security Bulletin 2022-08-01
CVE: CVE-2022-20350
Severity: HIGH
Type: ID
Affected AOSP versions: 10, 11, 12, 12L
References: A-228178437
[2]
[
Android Security Bulletin 2022-08-01
CVE: CVE-2022-20350
Severity: HIGH
Type: ID
Affected AOSP versions: 10, 11, 12, 12L
References: A-228178437
[2]
[3]
[4]
[5]
GHSA
GHSA-2452-xqvj-2c63: In onCreate of NotificationAccessConfirmationActivity
ghsa_unreviewed·2022-08-11
CVE-2022-20350 [MEDIUM] CWE-125 GHSA-2452-xqvj-2c63: In onCreate of NotificationAccessConfirmationActivity
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to trick the victim to grant notification access to the wrong app due to improper input validation. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-228178437
OSV
CVE-2022-20350: In onCreate of NotificationAccessConfirmationActivity
osv·2022-08-01
CVE-2022-20350 CVE-2022-20350: In onCreate of NotificationAccessConfirmationActivity
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to trick the victim to grant notification access to the wrong app due to improper input validation. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-08-10
Published