CVE-2022-20466 — Initialization of a Resource with an Insecure Default in Google Android

CWE-1188 — Initialization of a Resource with an Insecure Default6 documents6 sources

Severity

5.5MEDIUMNVD

EPSS

0.0%

top 88.92%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Platform Frameworks Base Platform Packages Apps Settings Google Android

Timeline

PublishedDec 13

Latest updateApr 16

Description

In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's password on a secondary display due to an insecure default value. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-179725730

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5google/androidAndroid-10 Android-11 Android-12 Android-12L Android-13

▶NVDgoogle/android4 versions+3

▶Androidplatform/frameworks_base10:0 — 10:2022-12-01+4

▶Androidplatform/packages_apps_settings12:0 — 12:2022-12-01+2

🔴Vulnerability Details

VulDB

Google Android 10.0/11.0/12.0/13.0 Notification NotificationShadeWindowControllerImpl.java applyKeyguardFlags information disclosure (A-179725730 / EUVD-2022-25726)↗2026-04-16

▶

GHSA

GHSA-6hp8-p722-7744: In applyKeyguardFlags of NotificationShadeWindowControllerImpl↗2022-12-13

▶

CVEList

CVE-2022-20466: In applyKeyguardFlags of NotificationShadeWindowControllerImpl↗2022-12-13

▶

OSV

CVE-2022-20466: In applyKeyguardFlags of NotificationShadeWindowControllerImpl↗2022-12-01

▶

📋Vendor Advisories

Android

CVE-2022-20466: Android Security Bulletin 2022-12-01 CVE: CVE-2022-20466 Severity: MEDIUM Type: ID Affected AOSP versions: 13 References: A-179725730 [2]↗2022-12-01

▶