What is CVE-2019-2193?

CVE-2019-2193 is a high-severity vulnerability in Google Android, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2019-11-13.

How severe is CVE-2019-2193?

High severity. CVSS v3 base score is 7.8 out of 10.

Privilege escalation in Google Android

CVE-2019-2193

In WelcomeActivity.java and related files, there is a possible permissions bypass due to a partially provisioned Device Policy Client. This could lead to local escalation of privilege, leaving an Admin app installed with no indication to the user, with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-132261064

Vulnerability class: Privilege Escalation

EPSS: 0.002 (6.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Google Android — versions 8.0, 8.1, 9.0
N/a Android — versions Android-8.0 Android-8.1 Android-9 Android-10

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

security@android.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2019-2193?: CVE-2019-2193 is a high-severity vulnerability in Google Android, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2019-11-13.
How severe is CVE-2019-2193?: High severity. CVSS v3 base score is 7.8 out of 10.