Conference StatusHints allow cross-user image access

2024-09-0100:00:00

Google

osv.dev

cross-user access

confused deputy

information disclosure

user interaction

connectionservicewrapper.java

AI Score

6.5

Confidence

High

EPSS

Percentile

9.6%

JSON

In handleCreateConferenceComplete of ConnectionServiceWrapper.java, there is a possible way to reveal images across users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.