CVE-2021-39747: Medium severity android vulnerability

Published Mar 30, 2022

Updated

In Settings Provider, there is a possible way to list values of non-readable global settings due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-208268457

Affected Software

1 affected component

Google Android=12.1

Event History

Mar 30, 2022

CVE Published

via MITRE·04:02 PM

Data Sourced

via MITRE·04:02 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs local access and low-level privileges on the affected Android device. No user interaction or additional execution privileges are required.

What is disclosed if exploitation succeeds?

The issue can allow listing values of global settings that should not be readable, resulting in local information disclosure. The available data does not identify which specific settings values may be exposed.

Which Android release is identified as affected?

The affected version listed is Android 12L.

CVE-2021-39747: Medium severity android vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is disclosed if exploitation succeeds?

Which Android release is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is disclosed if exploitation succeeds?

Which Android release is identified as affected?