CVE-2022-20458
published 2023-01-26CVE-2022-20458: The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey()…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.12%
2.5th percentile
The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey() could contain sensitive information. However, CarNotificationListener.java, it prints out the StatusBarNotification.getKey() directly in logs, which could contain user's account name (i.e. PII), in Android "user" build.Product: AndroidVersions: Android-12LAndroid ID: A-205567776
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Android 12.0 CarNotificationListener.java StatusBarNotification.getKey log file (A-205567776 / EUVD-2022-25718)
vuldb·2026-04-15·CVSS 5.5
CVE-2022-20458 [MEDIUM] Google Android 12.0 CarNotificationListener.java StatusBarNotification.getKey log file (A-205567776 / EUVD-2022-25718)
A vulnerability labeled as problematic has been found in Google Android 12.0. The affected element is the function StatusBarNotification.getKey of the file CarNotificationListener.java. The manipulation results in sensitive information in log files.
This vulnerability is known as CVE-2022-20458. Attacking locally is a requirement. No exploit is available.
It is best practice to apply a patch to resolve this issue.
GHSA
GHSA-m5r4-qhx5-2g4c: The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build
ghsa_unreviewed·2023-01-26
CVE-2022-20458 [MEDIUM] CWE-532 GHSA-m5r4-qhx5-2g4c: The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build
The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey() could contain sensitive information. However, CarNotificationListener.java, it prints out the StatusBarNotification.getKey() directly in logs, which could contain user's account name (i.e. PII), in Android "user" build.Product: AndroidVersions: Android-12LAndroid ID: A-205567776
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-01-26
Published