PT-2020-11739 · Google · Android

Published 2020-09-01 · Updated 2021-07-21 · CVE-2020-0386

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Android versions 8.0 through 11

Description A possible tapjacking vector exists due to an insecure default value in the onCreate method of RequestPermissionActivity.java. This could lead to local escalation of privilege, allowing an attacker to set Bluetooth discoverability with user execution privileges needed. User interaction is required for exploitation.

Recommendations For Android versions 8.0 through 11, consider restricting the use of the RequestPermissionActivity until a patch is available. As a temporary workaround, avoid using the onCreate method of RequestPermissionActivity.java to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Weakness Enumeration

CWE-1188

CWE-1021

Related Identifiers

ASB-A-155650356

CVE-2020-0386

Affected Products

Android

References · 6

• https://osv.dev/vulnerability/ASB-A-155650356 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-0386 · Vendor Advisory
• https://source.android.com/security/bulletin/2020-09-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0386 · Security Note
• https://t.me/cibsecurity/14724 · Telegram Post
• https://android.googlesource.com/platform/packages/apps/Settings/+/ba7f6d7d45776254791dea3b1f5d2acc0dc9b2dd · Note