PT-2022-14732 · Google · Android

Published 2022-12-16 · Updated 2022-12-20 · CVE-2022-20519

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Android versions prior to the fixed version

Description The issue is related to a missing permission check in the onCreate method of AddAppNetworksActivity.java. This could allow a guest user to configure WiFi networks, potentially leading to local escalation of privilege without requiring additional execution privileges. User interaction is not necessary for exploitation.

Recommendations For Android versions prior to the fixed version, consider restricting access to the WiFi network configuration feature to prevent unauthorized changes until a patch is available. As a temporary workaround, review and enforce strict permission controls on the AddAppNetworksActivity.java to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-20519

Affected Products

Android

References · 3

• https://osv.dev/vulnerability/CVE-2022-20519 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20519 · Security Note
• https://source.android.com/security/bulletin/pixel/2022-12-01 · Vendor Advisory