Vulnerability in Google Android
CVE-2022-20234
In Car Settings app, the NotificationAccessConfirmationActivity is exported. In NotificationAccessConfirmationActivity, it gets both 'mComponentName' and 'pkgTitle' from user.An unprivileged app can use a malicous mComponentName with a benign pkgTitle (e.g. Settings app) to make users enable notification access permission for the malicious app. That is, users believe they enable the notification access permission for the Settings app, but actually they enable the notification access permission for the malicious app.Once the malicious app gets the notification access permission, it can read all notifications, including users' personal information.Product: AndroidVersions: Android-12LAndroid ID: A-225189301
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (27.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 27.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.000
Affected products
- Google Android — versions 12.1
- Android — versions Android-12L
Weakness classification (CWE)
References
- source.android.com/security/bulletin/aaos/2022-07-01 (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-20234?
- CVE-2022-20234 is a high-severity vulnerability in Google Android, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 7.5/10. Published 2022-07-13.
- How severe is CVE-2022-20234?
- High severity. CVSS v3 base score is 7.5 out of 10.