PT-2022-14490 · Google · Android

Published 2022-08-11 · Updated 2023-08-08 · CVE-2022-20267

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-13

Description The issue concerns a missing permission check in Bluetooth, allowing for the enablement or disablement of Bluetooth connections without user consent. This could lead to local escalation of privilege, with user execution privileges required for exploitation. No user interaction is needed for exploitation.

Recommendations For Android version Android-13, apply the necessary patch or update to include the missing permission check for Bluetooth connections to prevent unauthorized enablement or disablement.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-20267

Affected Products

Android

References · 3

• https://source.android.com/security/bulletin/android-13 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20267 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20267 · Security Note