CVE-2022-20350: Input Validation
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to trick the victim to grant notification access to the wrong app due to improper input validation. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-228178437
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-20350?
The severity of CVE-2022-20350 is classified as medium due to the potential for local information disclosure.
How do I fix CVE-2022-20350?
To fix CVE-2022-20350, it is recommended to update to the latest versions of Android 10.0, 11.0, 12.0, or 12.1, which contain the necessary security patches.
What is affected by CVE-2022-20350?
CVE-2022-20350 affects Android versions 10.0, 11.0, 12.0, and 12.1.
Is user interaction required for CVE-2022-20350 exploitation?
No, user interaction is not required for CVE-2022-20350 exploitation.
What type of attack is associated with CVE-2022-20350?
CVE-2022-20350 is associated with unauthorized notification access being granted to potentially malicious applications.