CVE-2023-20919

EUVD-2023-25087 · Published Jan 26, 2023

In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-252663068

Technologies

Google Android

Weaknesses

CWE-693

CVSS scores

v3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Execution Privilege Escalation Stealth Credential Access Discovery Impact

T1068Exploitation for Privilege Escalation T1040Network Sniffing T1083File and Directory Discovery T1565.002Transmitted Data Manipulation T1574.005Executable Installer File Permissions Weakness T1574.010Services File Permissions Weakness T1611Escape to Host

References

https://source.android.com/security/bulletin/2023-01-01

Potentially impacted assets

See if this affects your attack surface