PT-2025-2670 · Google · Android+1

Published 2025-01-01 · Updated 2025-01-22 · CVE-2024-43765

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue involves a tapjacking/overlay attack that could allow access to a folder, potentially leading to local escalation of privilege. This requires user interaction for exploitation and necessitates user execution privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Clickjacking

Incorrect Default Permissions

Weakness Enumeration

CWE-1021

CWE-276

Related Identifiers

ASB-A-233605527

CVE-2024-43765

Affected Products

Android

Platform/Packages/Apps/Documentsui

References · 8

• https://osv.dev/vulnerability/ASB-A-233605527 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43765 · Vendor Advisory
• https://source.android.com/security/bulletin/2025-01-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43765 · Security Note
• https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/6a1dd25117d5406d3befe404335202623778736a · Note
• https://twitter.com/VulmonFeeds/status/1881992607766638929 · Twitter Post
• https://t.me/cvedetector/16060 · Telegram Post
• https://twitter.com/CVEnew/status/1881933301964833013 · Twitter Post