CVE-2023-21320

Published Oct 30, 2023

Last updated a year ago

CVSS medium 5.5

Overview

Description: In Device Policy, there is a possible way to verify if a particular admin app is registered on the device due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Source: security@android.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.5
Impact score: 3.6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-203

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "530F3220-8957-4F6C-9790-2D4A4CC4122B",
            "versionEndExcluding": "14.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References