CVE-2023-20960

2023-03-2400:00:00

google_android

www.cve.org

cve-2023-20960

launchdeeplinkintenttoright

input validation

local privilege escalation

user execution privileges

android-12l

android-13

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.6%

JSON

In launchDeepLinkIntentToRight of SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12L Android-13Android ID: A-250589026

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Android",
    "versions": [
      {
        "version": "Android-12L Android-13",
        "status": "affected"
      }
    ]
  }
]

References

source.android.com/security/bulletin/2023-03-01