PT-2020-11747 · Google · Android

Published 2020-09-01 · Updated 2021-07-21 · CVE-2020-0394

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions 8.0 through 11

Description A possible tapjacking vector exists due to an insecure default value in the onCreate method of BluetoothPairingDialog.java. This could lead to local escalation of privilege, allowing untrusted devices to access contact lists without needing additional execution privileges. User interaction is required for exploitation.

Recommendations For Android versions 8.0 through 11, consider restricting access to the BluetoothPairingDialog until a patch is available. As a temporary workaround, avoid using the Bluetooth pairing feature in these versions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Clickjacking

Weakness Enumeration

CWE-1188

CWE-1021

Related Identifiers

ASB-A-155648639

CVE-2020-0394

Affected Products

Android

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-0394 · Security Note
• https://source.android.com/security/bulletin/2020-09-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-155648639 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-0394 · Vendor Advisory
• https://android.googlesource.com/platform/packages/apps/Settings/+/f3afef8419de2910b03c3670ca25e63ac3c08407 · Note