CVE-2020-0454: Medium severity Google Android vulnerability
Published Nov 1, 2020
·Updated
In callCallbackForRequest of ConnectivityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure of the current SSID with User execution privileges needed. User interaction is not needed for exploitation.
Affected Software
3 affected componentsFixes available
Google Android=9.0
Google Android
android/platform/frameworks/base>=9:0<9:2020-11-01
9:2020-11-01
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 9:2020-11-01
Event History
Nov 1, 2020
Advisory Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionAffected Software
Nov 2, 2020
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Nov 10, 2020
CVE Published
via MITRE·12:51 PM
Data Sourced
via MITRE·12:51 PM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs local access and User-level execution privileges on an affected device. No user interaction is required.
2
What information could be exposed?
The issue could disclose the current SSID through a permission bypass in ConnectivityService.java.
3
Which versions are identified as affected?
The provided data identifies Android 9 as affected.