Lucene search

[email protected]NVD:CVE-2022-20214

HistoryJan 26, 2023 - 9:15 p.m.

CVE-2022-20214

2023-01-2621:15:25

CWE-1021

[email protected]

web.nvd.nist.gov

car settings app

tapjacking attack

system settings

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

29.5%

JSON

In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle button to enable apps to modify system settings without user consent.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-183411210

Affected configurations

Nvd

Node

googleandroidMatch10.0

googleandroidMatch11.0

googleandroidMatch12.0

VendorProductVersionCPE
googleandroid10.0cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*
googleandroid11.0cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*
googleandroid12.0cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	android	10.0	cpe:2.3:o:google:android:10.0:::::::*
google	android	11.0	cpe:2.3:o:google:android:11.0:::::::*
google	android	12.0	cpe:2.3:o:google:android:12.0:::::::*

References

source.android.com/security/bulletin/aaos/2023-01-01

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

29.5%

JSON

Related for NVD:CVE-2022-20214

cvelist1 prion1 cve1 androidsecurity1