CVE-2014-7922: Medium severity google play services vulnerability
The GoogleAuthUtil.getToken method in the Google Play services SDK before 2015 sets parameters in OAuth token requests upon finding a corresponding opt parameter in the Bundle extras argument, which allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scopes including the SID and LSID scopes, and consequently obtain access to a Google account, via a crafted application, as demonstrated by setting the haspermission=1 parameter value upon finding opthaspermission in that argument.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7922?
CVE-2014-7922 has a severity rating of high due to its potential for allowing unauthorized access to OAuth tokens.
How do I fix CVE-2014-7922?
To fix CVE-2014-7922, you should upgrade to a version of the Google Play services SDK that is higher than 6.1.
What software is affected by CVE-2014-7922?
CVE-2014-7922 affects the Google Play services SDK version 6.1 and earlier.
What are the implications of CVE-2014-7922?
The implications of CVE-2014-7922 include the potential for attackers to bypass consent dialogs and access OAuth tokens without proper authorization.
Is CVE-2014-7922 specific to Android applications?
Yes, CVE-2014-7922 specifically impacts Android applications that utilize the Google Play services SDK.