A vulnerability, which was classified as critical, was found in Google Android 11.0/12.0/13.0 (Smartphone Operating System). CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519

The weakness was disclosed 03/25/2023 as A-220302519. It is possible to read the advisory at source.android.com. This vulnerability is uniquely identified as CVE-2023-20963 since 11/03/2022. Technical details and a exploit are known. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 04/28/2024). It is expected to see the exploit prices for this product increasing in the near future.The attack technique deployed by this issue is T1587.003 according to MITRE ATT&CK.

It is declared as highly functional. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 04/13/2023 with a due date of 05/04/2023:

Apply updates per vendor instructions.

Applying a patch is able to eliminate this problem.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 11.0
• 12.0
• 13.0

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion