Lucene search

GoogleOSV:ASB-A-224771621

HistoryOct 01, 2023 - 12:00 a.m.

SQL Injection in ContactsProvider#query via URI PathSegments

2023-10-0100:00:00

Google

osv.dev

sql injection

contactsprovider

uri pathsegments

databaseutils.java

local info disclosure

user execution privileges

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

CPENameOperatorVersion
platform/frameworks/baseeq12
platform/frameworks/baseeq11
platform/frameworks/baseeq12L
platform/frameworks/baseeq13

Name	Operator	Version
platform/frameworks/base	eq	12
platform/frameworks/base	eq	11
platform/frameworks/base	eq	12L
platform/frameworks/base	eq	13

References

android.googlesource.com/platform/frameworks/base/+/3287ac2d2565dc96bf6177967f8e3aed33954253

source.android.com/security/bulletin/2023-10-01

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for OSV:ASB-A-224771621