PT-2020-11621 · Google · Android

Published 2020-09-17 · Updated 2020-10-30 · CVE-2020-0267

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to Android-11

Description In the WindowManager, there is a possible launch of an unexpected app due to a confused deputy. This could lead to local escalation of privilege due to launching a malicious app instead of the one the user intended, with no additional execution privileges needed. User interaction is needed for exploitation.

Recommendations For Android versions prior to Android-11, update to Android-11 or a later version to resolve the issue. As a temporary workaround, consider restricting the launch of unknown or untrusted apps to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-610

Related Identifiers

CVE-2020-0267

Affected Products

Android

References · 5

• https://osv.dev/vulnerability/CVE-2020-0267 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0267 · Security Note
• https://source.android.com/security/bulletin/android-11 · Vendor Advisory
• https://t.me/cibsecurity/14754 · Telegram Post
• https://t.me/sec_devops/354 · Telegram Post