Lucene search

GoogleOSV:ASB-A-281525042

HistoryMar 01, 2024 - 12:00 a.m.

ADP Grant - Enumerating other users' photos by providing PrinterDiscoverySession with a custom printer icon

2024-03-0100:00:00

Google

osv.dev

adp grant

printerdiscoverysession

printmanagerservice

information disclosure

confused deputy

local

6.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

In getCustomPrinterIcon of PrintManagerService.java, there is a possible way to view other user’s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CPENameOperatorVersion
platform/frameworks/baseeq12
platform/frameworks/baseeq14
platform/frameworks/baseeq12L
platform/frameworks/baseeq13

Name	Operator	Version
platform/frameworks/base	eq	12
platform/frameworks/base	eq	14
platform/frameworks/base	eq	12L
platform/frameworks/base	eq	13

References

android.googlesource.com/platform/frameworks/base/+/74b03835a7fac15e854d08159922418c99e27e77

source.android.com/security/bulletin/2024-03-01