CVE-2022-20467: Medium severity Google Android vulnerability

Published Mar 6, 2023

Updated

In isBluetoothShareUri of BluetoothOppUtility.java, there is a possible incorrect file read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-225880741

Affected Software

5 affected components

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android

Event History

Mar 6, 2023

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Mar 24, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2022-20467?

CVE-2022-20467 has a moderate severity rating as it could lead to local information disclosure without requiring additional execution privileges.

How do I fix CVE-2022-20467?

To mitigate CVE-2022-20467, users should update their Android devices to the latest available version that includes security patches.

What versions of Android are affected by CVE-2022-20467?

CVE-2022-20467 affects Android versions 11, 12, 12.1, and 13.

Is user interaction needed to exploit CVE-2022-20467?

Yes, exploitation of CVE-2022-20467 requires user interaction.

What type of exposure does CVE-2022-20467 present?

CVE-2022-20467 presents a potential for local information disclosure.