Lucene search

GoogleOSV:ASB-A-281534749

HistoryOct 01, 2023 - 12:00 a.m.

ADP Grant - Enumerating other users' contact photos via Dataset presentation shown in AutoFillService's FillUi

2023-10-0100:00:00

Google

osv.dev

adp grant

enumerating contact photos

autofillservice

fillui

confused deputy

local information disclosure

user interaction not needed

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.4

Confidence

High

EPSS

Percentile

5.1%

JSON

In FillUi of FillUi.java, there is a possible way to view another user’s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

References

android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33

source.android.com/security/bulletin/2023-10-01

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.4

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for OSV:ASB-A-281534749