PT-2021-13137 · Google · Android

Published 2021-05-01 · Updated 2022-07-12 · CVE-2021-0481

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Android versions 8.1 through 11

Description: The issue is related to an unexpected URI handler in the EditUserPhotoController.java file, which could allow access to unauthorized files. This might lead to local escalation of privilege without requiring additional execution privileges. User interaction is necessary for exploitation.

Recommendations: For Android versions 8.1 through 11, consider restricting access to sensitive files and directories to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the affected URI handler in the EditUserPhotoController.java file.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ASB-A-172939189

CVE-2021-0481

Affected Products

Android

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-0481 · Security Note
• https://source.android.com/security/bulletin/2021-05-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-0481 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-172939189 · Vendor Advisory
• https://android.googlesource.com/platform/packages/apps/Settings/+/d4f04398c71f67bc13f85e098e1dc71d840c1a4a · Note