Lucene search

Google_androidCVE-2024-31315

HistoryJul 09, 2024 - 9:15 p.m.

CVE-2024-31315

2024-07-0921:15:13

google_android

web.nvd.nist.gov

cve-2024-31315

reserved

disclosure

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

6.8

Confidence

High

EPSS

Percentile

9.2%

JSON

In multiple functions of ManagedServices.java, there is a possible way to hide an app with notification access in the Device & app notifications settings due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Affected configurations

Vulners

Vulnrichment

Node

googleandroidMatch14

googleandroidMatch13

googleandroidMatch14

googleandroidMatch13

googleandroidMatch12l

googleandroidMatch14

googleandroidMatch13

googleandroidMatch12l

googleandroidMatch12

VendorProductVersionCPE
googleandroid14cpe:2.3:o:google:android:14:*:*:*:*:*:*:*
googleandroid13cpe:2.3:o:google:android:13:*:*:*:*:*:*:*
googleandroid12lcpe:2.3:o:google:android:12l:*:*:*:*:*:*:*
googleandroid12cpe:2.3:o:google:android:12:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	android	14	cpe:2.3:o:google:android:14:::::::*
google	android	13	cpe:2.3:o:google:android:13:::::::*
google	android	12l	cpe:2.3:o:google:android:12l:::::::*
google	android	12	cpe:2.3:o:google:android:12:::::::*

CNA Affected

[
  {
    "vendor": "Google",
    "product": "Android",
    "versions": [
      {
        "version": "14",
        "status": "affected"
      },
      {
        "version": "13",
        "status": "affected"
      },
      {
        "version": "12L",
        "status": "affected"
      },
      {
        "version": "12",
        "status": "affected"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

android.googlesource.com/platform/frameworks/base/+/a9ee2793068235ff423d08cc0964870c054d1983

source.android.com/security/bulletin/2024-06-01

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

6.8

Confidence

High

EPSS

Percentile

9.2%

JSON

Related for CVE-2024-31315