CVE-2022-29580

Published Dec 13, 2022

Last updated a year ago

Overview

Description: There exists a path traversal vulnerability in the Android Google Search app. This is caused by the incorrect usage of uri.getLastPathSegment. A symbolic encoded string can bypass the path logic to get access to unintended directories. An attacker can manipulate paths that could lead to code execution on the device. We recommend upgrading beyond version 13.41
Source: cve-coordination@google.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-22
cve-coordination@google.com: CWE-427

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:google:google_search:*:*:*:*:*:android:*:*",
            "vulnerable": true,
            "matchCriteriaId": "00F2556B-6E0B-4C39-933F-FFDB0E12B1C8",
            "versionEndExcluding": "13.41"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References