PT-2022-14458 · Google · Android

Published 2022-07-13 · Updated 2022-07-26 · CVE-2022-20234

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-12L

Description The issue arises in the Car Settings app where the NotificationAccessConfirmationActivity is exported, allowing an unprivileged app to manipulate mComponentName and pkgTitle to deceive users into enabling notification access permission for a malicious app. Users may believe they are enabling this permission for a benign app, such as the Settings app, but in reality, they are granting it to the malicious app. Once the malicious app obtains this permission, it can read all notifications, including personal information.

Recommendations For Android version Android-12L, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-20234

Affected Products

Android

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-20234 · Security Note
• https://source.android.com/security/bulletin/aaos/2022-07-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20234 · Vendor Advisory
• https://t.me/cibsecurity/46178 · Telegram Post
• https://t.me/cvenotify/33008 · Telegram Post