ID CVE-2020-0473
Summary In updateIncomingFileConfirmNotification of BluetoothOppNotification.java, there is a possible permissions bypass. This could lead to local escalation of privilege allowing an attacker with physical possession of the device to transfer files to it over Bluetooth, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-160691486
References
Vulnerable Configurations
  • cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*
CVSS
Base: 2.1 (as of 16-12-2020 - 18:26)
Impact:
Exploitability:
CWE CWE-863
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:L/AC:L/Au:N/C:N/I:P/A:N
refmap via4
misc https://source.android.com/security/bulletin/pixel/2020-12-01
Last major update 16-12-2020 - 18:26
Published 15-12-2020 - 16:15
Last modified 16-12-2020 - 18:26
Back to Top