PT-2018-5557 · Google · Android

Published 2018-04-04 · Updated 2018-05-09 · CVE-2017-13274

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Android versions 6.0 through 8.1

Description: The issue concerns incorrect web origin determination in the getHost() function of UriTest.java. This could lead to incorrect security decisions without requiring additional execution privileges. User interaction is not necessary for exploitation.

Recommendations: For Android versions 6.0 through 8.1, update to a version that contains a fix for this issue to prevent incorrect security decisions.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2017-13274

Affected Products

Android

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-13274 · Security Note
• https://source.android.com/security/bulletin/2018-04-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-13274 · Vendor Advisory