PT-2023-17719 · Google · Android

Publicado 2023-03-01 · Atualizado 2023-03-29 · CVE-2023-20929

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions prior to the fixed version

Description The issue allows for local information disclosure due to an unrestricted broadcast intent in the sendHalfSheetCancelBroadcast function of HalfSheetActivity.java. This could lead to the disclosure of nearby BT MAC addresses without requiring additional execution privileges or user interaction.

Recommendations For Android versions prior to the fixed version, consider restricting the broadcast intent in the sendHalfSheetCancelBroadcast function of HalfSheetActivity.java to prevent local information disclosure.

Correção

Identificadores relacionados

ASB-A-234442700

CVE-2023-20929

Produtos afetados

Android

Referências · 5

• https://android.googlesource.com/platform/packages/modules/Connectivity/+/be99ea27e22ef97aec9a95ba6d5f52e954e9f2a7 · Nota
• https://source.android.com/security/bulletin/2023-03-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-20929 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-20929 · Aviso do Fabricante
• https://osv.dev/vulnerability/ASB-A-234442700 · Aviso do Fabricante