[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2022-23835":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":24,"cwes":25,"cpes":27,"technologies":29,"references":31,"score":34,"epss_score":35,"epss_percentile":36,"is_kev":37,"cisa_kev_date_added":38,"cisa_kev_due_date":38,"cisa_ssvc":39,"attack_mappings":45,"exploits":52},308097,"CVE-2022-23835","EUVD-2022-28763","The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an application that has the READ_SMS permission, and reads an IMAP credentialing message that is (by design) not displayed to the victim within the AOSP SMS\u002FMMS messaging application. (Often, the IMAP credentials are usable to listen to voice mail messages sent before the vulnerability was exploited, in addition to new ones.) NOTE: some vendors characterize this as not a \"concrete and exploitable risk.","2022-02-25T04:15:00Z",{"cvss_v2.0":10,"cvss_v3.1":18},{"version":11,"baseScore":12,"accessVector":13,"vectorString":14,"authentication":15,"integrityImpact":15,"accessComplexity":16,"availabilityImpact":15,"confidentialityImpact":17},"2.0",4.3,"NETWORK","AV:N\u002FAC:M\u002FAu:N\u002FC:P\u002FI:N\u002FA:N","NONE","MEDIUM","PARTIAL",{"scope":19,"version":20,"baseScore":21,"attackVector":13,"baseSeverity":22,"vectorString":23,"integrityImpact":22,"userInteraction":15,"attackComplexity":22,"availabilityImpact":22,"privilegesRequired":15,"confidentialityImpact":22},"UNCHANGED","3.1",8.1,"HIGH","CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",true,[26],"CWE-668",[28],"cpe:2.3:a:visual_voice_mail_project:visual_voice_mail:*:*:*:*:*:android:*:*",[30],"Visual_Voice_Mail_Project Visual Voice Mail",[32,33],"https:\u002F\u002Fgitlab.com\u002Fkop316\u002Fvvm-disclosure","https:\u002F\u002Fwww.kb.cert.org\u002Fvuls\u002Fid\u002F383864",0.76,0.01428,0.72796,false,null,{"timestamp":38,"automatable":40,"tech_impact":41,"exploitation":42,"cisa_decision":43,"cisa_remediation_timeline":44},"no","partial","none",{},"FSU",[46],{"name":47,"source":48,"tactics":49,"technique_id":51},"Exploit Public-Facing Application","attack_vector",[50],"initial-access","T1190",[53],{"link":32}]