In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-252663068
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
CVE-2023-20919 - High Severity Vulnerability
Vulnerable Library - baseandroid-10.0.0_r44
Android framework classes and services
Library home page: https://android.googlesource.com/platform/frameworks/base
Found in HEAD commit: 74e99e1fdb5f82152e45f0e0a6a34be71fbe08d3
Found in base branch: master
Vulnerable Source Files (1)
Vulnerability Details
In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-252663068
Publish Date: 2023-01-26
URL: CVE-2023-20919
CVSS 3 Score Details (7.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://android.googlesource.com/platform/frameworks/base/+/c224467912010cce927d206366d772f511c98728
Release Date: 2022-11-04
Fix Resolution: android-13.0.0_r19
Step up your Open Source Security Game with Mend here