PT-2022-14685 · Google · Android

Published 2022-12-01 · Updated 2022-12-15 · CVE-2022-20466

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-10 through Android-13

Description The issue allows for local information disclosure due to an insecure default value in the applyKeyguardFlags function of NotificationShadeWindowControllerImpl.java. This could enable an attacker to observe the user's password on a secondary display. User interaction is required for exploitation.

Recommendations For Android versions Android-10 through Android-13, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1188

Related Identifiers

ASB-A-179725730

CVE-2022-20466

Affected Products

Android

References · 6

• https://osv.dev/vulnerability/CVE-2022-20466 · Vendor Advisory
• https://source.android.com/security/bulletin/2022-12-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20466 · Security Note
• https://osv.dev/vulnerability/ASB-A-179725730 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/6888543d3a6cde5a9e16f9accb0a4256152aba2d · Note
• https://android.googlesource.com/platform/packages/apps/Settings/+/98239c0da68917a0622c24e9af16ce06768a68f2 · Note