Information disclosure

2023-08-1422:15:00

PRIOn knowledge base

www.prio-n.com

information disclosure

confused deputy

local exploitation

user images

5.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

In setMetadata of MediaSessionRecord.java, there is a possible way to view another user’s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CPENameOperatorVersion
androideq11.0
androideq12.0
androideq13.0
androideq12.1

Name	Operator	Version
android	eq	11.0
android	eq	12.0
android	eq	13.0
android	eq	12.1

References

android.googlesource.com/platform/frameworks/base/+/0c3b7ec3377e7fb645ec366be3be96bb1a252ca1

source.android.com/security/bulletin/2023-08-01