Summaryinfo

A vulnerability, which was classified as critical, was found in Google Android 12.0. This issue affects the function NotificationAccessConfirmationActivity of the component Notification Handler. The manipulation of the argument mComponentName results in permission. This vulnerability is identified as CVE-2022-20234. The attack is only possible with local access. There is not any exploit available. Applying a patch is advised to resolve this issue. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Detailsinfo

A vulnerability was found in Google Android 12.0 (Smartphone Operating System). It has been classified as problematic. Affected is the function NotificationAccessConfirmationActivity of the component Notification Handler. The manipulation of the argument mComponentName with an unknown input leads to a permission vulnerability. CWE is classifying the issue as CWE-275. This is going to have an impact on confidentiality. CVE summarizes:

In Car Settings app, the NotificationAccessConfirmationActivity is exported. In NotificationAccessConfirmationActivity, it gets both 'mComponentName' and 'pkgTitle' from user.An unprivileged app can use a malicous mComponentName with a benign pkgTitle (e.g. Settings app) to make users enable notification access permission for the malicious app. That is, users believe they enable the notification access permission for the Settings app, but actually they enable the notification access permission for the malicious app.Once the malicious app gets the notification access permission, it can read all notifications, including users' personal information.Product: AndroidVersions: Android-12LAndroid ID: A-225189301

The weakness was released 07/14/2022 as A-225189301. The advisory is shared for download at source.android.com. This vulnerability is traded as CVE-2022-20234 since 10/14/2021. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/31/2022). It is expected to see the exploit prices for this product increasing in the near future.The MITRE ATT&CK project declares the attack technique as T1222.

Applying a patch is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 12.0

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion