PT-2020-11767 · Google · Android

Published 2020-10-01 · Updated 2020-10-16 · CVE-2020-0416

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions 8.0 through 11

Description The issue allows for tapjacking attacks due to an insecure default value in multiple settings screens. This could lead to local escalation of privilege and permissions with no additional execution privileges needed, requiring user interaction for exploitation.

Recommendations For Android versions 8.0 through 11, update to a version that includes the fix for this issue to prevent tapjacking attacks and potential privilege escalation.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

ASB-A-155288585

CVE-2020-0416

Affected Products

Android

References · 7

• https://source.android.com/security/bulletin/2020-10-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0416 · Security Note
• https://osv.dev/vulnerability/CVE-2020-0416 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-155288585 · Vendor Advisory
• https://android.googlesource.com/platform/packages/apps/Settings/+/ee4ec4b33fddb16606136f656db186ada767e8a5 · Note
• https://android.googlesource.com/platform/packages/apps/Settings/+/4794b798c427c53a9d0f8c608c367a3e6469ed5f · Note
• https://t.me/cibsecurity/15119 · Telegram Post