Code injection

The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiality...

PT-2023-15723 · Unknown · Mediaprovider

Name of the Vulnerable Software and Affected Versions: MediaProvider affected versions not specified Description: The issue concerns a vulnerability in permission verification within the MediaProvider module. This could potentially impact confidentiality if successfully exploited. Recommendations...

CVE-2022-48347

The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2022-48348

The CVE-2022-48348 entries describe a vulnerability in the MediaProvider module that permits unauthorized data read, raising confidentiality and integrity concerns. The exposed details indicate the issue affects the MediaProvider component (in the context of HarmonyOS-related references) and coul...

CVE-2022-48348

The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiality and integrity...

PT-2023-15724 · Unknown · Mediaprovider

Name of the Vulnerable Software and Affected Versions: MediaProvider affected versions not specified Description: The issue affects the confidentiality and integrity of data due to a vulnerability in the MediaProvider module that allows unauthorized data read. Recommendations: At the moment, ther...

CVE-2022-48347

The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2022-48348

The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiality and integrity...

CVE-2022-48347

CVE-2022-48347 concerns a vulnerability in the MediaProvider module ’s permission verification. The NVD entry reports a CVSS v3.1 base score of 7.5 (HIGH) with network attack vector, low attack complexity, no privileges required, no user interaction, and a confidentiality impact. Multiple records...

ASB-A-201667614

In multiple locations of MediaProvider.java, there is a possible way to get read/write access to other applications’ dedicated, app-specific directory within external storage due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed...

CVE-2022-20395

In checkAccess of MediaProvider.java, there is a possible file deletion due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12...

CVE-2022-20395

In checkAccess of MediaProvider.java, there is a possible file deletion due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12...

CVE-2022-20395

In checkAccess of MediaProvider.java, there is a possible file deletion due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12...

ASB-A-221855295

In checkAccess of MediaProvider.java, there is a possible file deletion due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-197302116

In checkUriPermission of MediaProvider.java , there is a possible way to gain access to the content of media provider collections due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for...

CVE-2021-39663

In openFileAndEnforcePathPermissionsHelper of MediaProvider.java, there is a possible bypass of a permissions check due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2021-39662

In checkUriPermission of MediaProvider.java , there is a possible way to gain access to the content of media provider collections due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for...

Design/Logic Flaw

In openFileAndEnforcePathPermissionsHelper of MediaProvider.java, there is a possible bypass of a permissions check due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2021-39663

CVE-2021-39663 affects Android 10 and is linked to MediaProvider.java’s openFileAndEnforcePathPermissionsHelper. The vulnerability describes a bypass of a permissions check caused by a confused deputy, enabling local elevation of privilege without user interaction. The Android CVE entry documents...

CVE-2021-39663

In openFileAndEnforcePathPermissionsHelper of MediaProvider.java, there is a possible bypass of a permissions check due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product:...