CVE-2024-23706 — Improper Input Validation in Packages Modules Healthfitness

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 99.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform Packages Modules HealthfitnessGoogle Android
Timeline
PublishedMay 7

Description

In multiple locations, there is a possible bypass of health data permissions due to an improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶Androidplatform/packages_modules_healthfitness14-next:0 — 14-next:2024-05-01+1
▶CVEListV5google/android14
▶NVDgoogle/android14.0

Patches

Patch: android.googlesource.com ↗Patch: source.android.com ↗Patch: android.googlesource.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-3g5p-5p6j-r9qp: In multiple locations, there is a possible bypass of health data permissions due to an improper input validation↗2024-05-07
▶
OSV
CVE-2024-23706: In multiple locations, there is a possible bypass of health data permissions due to an improper input validation↗2024-05-01
▶

📋Vendor Advisories

1
Android
CVE-2024-23706: Android Security Bulletin 2024-05-01 CVE: CVE-2024-23706 Severity: CRITICAL Type: EoP Affected AOSP versions: 14 References: A-328068777↗2024-05-01
▶