CVE-2021-39746: High severity android vulnerability
Published Mar 30, 2022
·Updated
In PermissionController, there is a possible way to delete some local files due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-194696395
Affected Software
1 affected component
Google Android=12.1
Event History
Mar 30, 2022
CVE Published
via MITRE·04:02 PM
Data Sourced
via MITRE·04:02 PM
DescriptionWeakness
Frequently Asked Questions
1
Which systems are in scope?
The affected product is Google Android, and the listed affected version is Android 12L.
2
What access does an attacker need to exploit this issue?
Exploitation is local and requires User execution privileges. No user interaction is required.
3
What is the potential impact of successful exploitation?
An attacker may be able to delete some local files through an unsafe PendingIntent, resulting in local escalation of privilege. The CVSS vector indicates high confidentiality, integrity, and availability impact.