PT-2022-11026 · Google · Android

Published 2022-03-30 · Updated 2022-04-05 · CVE-2021-39748

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions prior to the fixed version

Description The issue allows for local information disclosure due to an unsafe PendingIntent in the InputMethodEditor. This could lead to accessing certain files that are accessible to Settings, without requiring additional execution privileges or user interaction.

Recommendations For Android versions prior to the fixed version, consider restricting access to sensitive files and directories to minimize the risk of exploitation until a patch is available.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-39748

Affected Products

Android

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-39748 · Security Note
• https://source.android.com/security/bulletin/android-12l · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39748 · Vendor Advisory