PT-2022-14739 · Google · Android

Published 2022-12-16 · Updated 2025-04-21 · CVE-2022-20525

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-13

Description The issue is related to a permissions bypass in the enforceVisualVoicemailPackage function of PhoneInterfaceManager.java, which could lead to a leak of the visual voicemail package name. This leak may result in local escalation of privilege without requiring additional execution privileges. User interaction is not necessary for exploitation.

Recommendations For Android version Android-13, apply the necessary patch or update to resolve the permissions bypass issue in the enforceVisualVoicemailPackage function of PhoneInterfaceManager.java. As a temporary workaround, consider restricting access to sensitive features related to visual voicemail until a patch is available.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2022-20525

Affected Products

Android

References · 5

• https://osv.dev/vulnerability/CVE-2022-20525 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20525 · Security Note
• https://source.android.com/security/bulletin/pixel/2022-12-01 · Vendor Advisory
• https://t.me/cvenotify/119151 · Telegram Post
• https://t.me/cibsecurity/54730 · Telegram Post