Path Traversal in Android Play Core Library
CVE-2020-8913
A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a directory traversal, execute code as the targeted application and access the targeted application's data on the Android device. We recommend all users update Play Core to version 1.7.2 or later.
EPSS: 0.029 (85.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Android Play_core_library
- Google Llc Android Play Core — versions stable
Weakness classification (CWE)
Public proof-of-concept exploits
- 0xSojalSec/Mobile-Application-Security
- 0xSojalSec/android-security-resource
- 0xsaju/awesome-android-security
- ARPSyndicate/cvemon
- B3nac/Android-Reports-and-Resources
- CyberLegionLtd/awesome-android-security
- Jack111I/For-Mobile-Security
- Live-Hack-CVE/CVE-2020-8913
- Mehedi-Babu/mobile_
- Raunaksplanet/Learn-android-bug-bounty
References
- cve-coordination@google.com (x_refsource_CONFIRM, Release Notes, Vendor Advisory)
- cve-coordination@google.com (Technical Description, x_refsource_CONFIRM, Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-8913?
- CVE-2020-8913 is a high-severity vulnerability in Android Play Core Library, classified under Improper Preservation of Permissions. CVSS score: 8.8/10. Published 2020-08-12.
- How severe is CVE-2020-8913?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2020-8913 known to be exploited?
- 25 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.