PT-2020-11731 · Google · Android

Published 2020-10-01 · Updated 2020-10-16 · CVE-2020-0378

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-9 through Android-11

Description A missing permission check in the onWnmFrameReceived function of PasspointManager.java could lead to local information disclosure of location data. This issue requires user execution privileges to exploit and does not need user interaction.

Recommendations For Android versions Android-9 through Android-11, apply the necessary patches or updates to include the missing permission check in the onWnmFrameReceived function of PasspointManager.java.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ASB-A-157748906

CVE-2020-0378

Affected Products

Android

References · 5

• https://source.android.com/security/bulletin/2020-10-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0378 · Security Note
• https://osv.dev/vulnerability/ASB-A-157748906 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-0378 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/opt/net/wifi/+/6f1aafe2d4b979cf64ab7a5150a021f977cfed37 · Note