PT-2022-14750 · Google · Android

Published 2022-12-16 · Updated 2022-12-21 · CVE-2022-20537

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-13

Description A missing permission check in the createDialog of WifiScanModeActivity.java allows a Guest user to enable location-sensitive settings. This could lead to local escalation of privilege from the Guest user with no additional execution privileges needed. User interaction is not required for exploitation.

Recommendations For Android version Android-13, apply the necessary permission checks in the createDialog of WifiScanModeActivity.java to prevent unauthorized access to location-sensitive settings.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-20537

Affected Products

Android

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-20537 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20537 · Vendor Advisory
• https://source.android.com/security/bulletin/pixel/2022-12-01 · Vendor Advisory