PT-2021-16564 · Google · Android

CVE-2021-25373 · Published 2021-04-09 · Updated 2022-08-12

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Customization Service versions prior to 2.2.02.1 in Android O(8.x) Customization Service versions prior to 2.4.03.0 in Android P(9.0) Customization Service versions prior to 2.7.02.1 in Android Q(10.0) Customization Service versions prior to 2.9.01.1 in Android R(11.0)

Description: The issue allows local attackers to perform unauthorized actions without permission by hijacking the PendingIntent. This is due to the use of unsafe PendingIntent in the Customization Service.

Recommendations: For versions prior to 2.2.02.1 in Android O(8.x), update to version 2.2.02.1 or later. For versions prior to 2.4.03.0 in Android P(9.0), update to version 2.4.03.0 or later. For versions prior to 2.7.02.1 in Android Q(10.0), update to version 2.7.02.1 or later. For versions prior to 2.9.01.1 in Android R(11.0), update to version 2.9.01.1 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2021-25373

Affected Products

Android

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-25373 · Security Note
• https://security.samsungmobile.com/serviceWeb.smsb · Vendor Advisory
• https://security.samsungmobile.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25373 · Vendor Advisory