CVE-2022-20081: Medium severity Google Android vulnerability
In A-GPS, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:unknown:to a version that resolves this vulnerability.Fixed in SoCVersion:2022-04-05 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ALPS06461919
Event History
Frequently Asked Questions
What is the severity of CVE-2022-20081?
The severity of CVE-2022-20081 is classified as medium with a CVSS score of 5.9.
What type of attack can CVE-2022-20081 facilitate?
CVE-2022-20081 can facilitate a possible man-in-the-middle attack due to improper certificate validation.
What is the impact of CVE-2022-20081?
CVE-2022-20081 may lead to remote information disclosure without requiring additional execution privileges.
Does CVE-2022-20081 require user interaction for exploitation?
No, CVE-2022-20081 does not require user interaction for exploitation.
How can I mitigate CVE-2022-20081?
To mitigate CVE-2022-20081, apply the available patch identified as ALPS06461919.