CVE-2023-20918: XEE
In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 13-next:2023-07-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 11:2023-07-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2023-07-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12L:2023-07-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 13:2023-07-01
Event History
Frequently Asked Questions
What is the severity of CVE-2023-20918?
CVE-2023-20918 has a moderate severity level due to potential elevation of privilege.
How can I fix CVE-2023-20918?
To address CVE-2023-20918, users should apply the latest security updates provided by Google for affected Android versions.
What versions of Android are affected by CVE-2023-20918?
CVE-2023-20918 affects Android versions 11.0, 12.0, 12.1, and 13.0.
Does CVE-2023-20918 require user interaction to exploit?
No, CVE-2023-20918 can be exploited without any user interaction.
What is the nature of the vulnerability in CVE-2023-20918?
CVE-2023-20918 is characterized as a confused deputy vulnerability that allows elevation of privilege.