CVE-2019-2197: Medium severity Google Android vulnerability

Published Nov 4, 2019

Updated

In processPhonebookAccess of CachedBluetoothDevice.java, there is a possible permission bypass due to an insecure default value. This could lead to local information disclosure of the user's contact list with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-138529441

Affected Software

5 affected components

Google Android=8.0

Google Android=8.1

Google Android=9.0

Google Android=10.0

Google Android

Event History

Nov 4, 2019

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Nov 13, 2019

CVE Published

via MITRE·05:34 PM

Data Sourced

via MITRE·05:34 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-2197?

CVE-2019-2197 has been classified as a high severity vulnerability due to its potential for local information disclosure.

How do I fix CVE-2019-2197?

To fix CVE-2019-2197, update your Android device to the latest version provided by your device manufacturer.

What does CVE-2019-2197 affect?

CVE-2019-2197 affects Android versions 8.0, 8.1, 9.0, and 10.0.

Can CVE-2019-2197 be exploited remotely?

No, CVE-2019-2197 requires local user interaction for exploitation.

What type of vulnerability is CVE-2019-2197?

CVE-2019-2197 is a permission bypass vulnerability that can lead to unauthorized access to a user's contact list.