CVE-2024-23705 — Improper Input Validation in Frameworks Base

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 82.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform Frameworks BaseGoogle Android
Timeline
PublishedMay 7

Description

In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶Androidplatform/frameworks_base14-next:0 — 14-next:2024-05-01+4
▶CVEListV5google/android4 versions+3
▶NVDgoogle/android4 versions+3

Patches

Patch: android.googlesource.com ↗Patch: source.android.com ↗Patch: android.googlesource.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-37jj-p98x-q9ff: In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation↗2024-05-07
▶
OSV
CVE-2024-23705: In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation↗2024-05-01
▶

📋Vendor Advisories

1
Android
CVE-2024-23705: Android Security Bulletin 2024-05-01 CVE: CVE-2024-23705 Severity: HIGH Type: EoP Affected AOSP versions: 12, 12L, 13, 14 References: A-293602970↗2024-05-01
▶