PT-2022-14714 · Google · Android

Published 2022-12-01 · Updated 2022-12-15 · CVE-2022-20501

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-10 through Android-13

Description The issue allows an attacker to potentially mislead a user into enabling a malicious phone account due to a tapjacking/overlay attack in the onCreate method of EnableAccountPreferenceActivity.java. This could lead to local escalation of privilege, requiring user interaction for exploitation and needing User execution privileges.

Recommendations For Android versions Android-10 through Android-13, consider restricting access to the EnableAccountPreferenceActivity until a patch is available, and avoid user interactions that could lead to the exploitation of this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

ASB-A-246933359

CVE-2022-20501

Affected Products

Android

References · 7

• https://osv.dev/vulnerability/ASB-A-246933359 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20501 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20501 · Vendor Advisory
• https://source.android.com/security/bulletin/2022-12-01 · Vendor Advisory
• https://t.me/cvenotify/39953 · Telegram Post
• https://android.googlesource.com/platform/packages/services/Telecomm/+/a7d57ace5819c4eef340aaf6744ad441d0369035 · Note
• https://t.me/cvenotify/39748 · Telegram Post