CVE-2020-8913 Local arbitrary code execution in splitinstall in Android's Play Core

2020-08-1207:10:12

CWE-281

Google

www.cve.org

cve-2020-8913

splitcompat.install

directory traversal

play core library

android

code execution

security update

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

51.4%

JSON

A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android’s Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a directory traversal, execute code as the targeted application and access the targeted application’s data on the Android device. We recommend all users update Play Core to version 1.7.2 or later.

CNA Affected

[
  {
    "platforms": [
      "Android"
    ],
    "product": "Android Play Core",
    "vendor": "Google LLC",
    "versions": [
      {
        "lessThan": "1.7.2",
        "status": "affected",
        "version": "stable",
        "versionType": "custom"
      }
    ]
  }
]