CVE-2022-20499: Medium severity Google Android vulnerability
Published Mar 6, 2023
·Updated
In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-246539931
Affected Software
4 affected components
Google Android=12.0
Google Android=12.1
Google Android=13.0
Google Android
Event History
Mar 6, 2023
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Mar 24, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2022-20499.
2
What is the severity of CVE-2022-20499?
The severity of CVE-2022-20499 is high.
3
What is the affected software of CVE-2022-20499?
The affected software of CVE-2022-20499 is Google Android versions 12.0, 12.1, and 13.0.
4
How can CVE-2022-20499 be exploited?
CVE-2022-20499 can be exploited by uncaught errors in parsing stored configs, leading to a local persistent denial of service.
5
Is user interaction required for the exploitation of CVE-2022-20499?
No, user interaction is not needed for the exploitation of CVE-2022-20499.