What is CVE-2022-20350?

CVE-2022-20350 is a medium-severity vulnerability in Google Android, classified under Improper Input Validation. CVSS score: 5.5/10. Published 2022-08-10.

How severe is CVE-2022-20350?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Out-of-bounds Read in Google Android

CVE-2022-20350

In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to trick the victim to grant notification access to the wrong app due to improper input validation. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-228178437

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.001 (0.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Google Android — versions 10.0, 11.0, 12.0
N/a Android — versions Android-10 Android-11 Android-12 Android-12L

Weakness classification (CWE)

References

security@android.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-20350?: CVE-2022-20350 is a medium-severity vulnerability in Google Android, classified under Improper Input Validation. CVSS score: 5.5/10. Published 2022-08-10.
How severe is CVE-2022-20350?: Medium severity. CVSS v3 base score is 5.5 out of 10.