Lucene search

K
osvGoogleOSV:ASB-A-292104015
HistoryFeb 01, 2024 - 12:00 a.m.

Dataset.mInlinePresentation` can contains cross user slice, which will lead to cross user image render

2024-02-0100:00:00
Google
osv.dev
14
information disclosure
missing permission check
local execution

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

Related for OSV:ASB-A-292104015