PT-2022-14578 · Google · Android

Published 2022-08-01 · Updated 2023-08-08 · CVE-2022-20352

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-12 through Android-12L

Description A local information disclosure issue exists due to a missing permission check in the addProviderRequestListener method of LocationManagerService.java. This allows an attacker to learn which packages request location information without needing additional execution privileges. User interaction is not required for exploitation.

Recommendations For Android versions Android-12 through Android-12L, consider restricting access to location information until a patch is available. As a temporary workaround, review and limit the packages that can request location data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ASB-A-222473855

CVE-2022-20352

Affected Products

Android

References · 6

• https://osv.dev/vulnerability/CVE-2022-20352 · Vendor Advisory
• https://source.android.com/security/bulletin/2022-08-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-222473855 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20352 · Security Note
• https://android.googlesource.com/platform/frameworks/base/+/ec3a20c2b28906247e7d13ae4af17c701dd5ee21 · Note
• https://android.googlesource.com/platform/frameworks/base/+/f796ac71c3c583139d7cfe8cc70fd1f2f4e251a0 · Note