CVE-2023-20918: XEE
Published Jul 5, 2023
·Updated
In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
5 affected components
Google Android=11.0
Google Android=12.0
Google Android=12.1
Google Android=13.0
Google Android
Remediation
Patch Available
Event History
Jul 5, 2023
CVE Published
via Android·12:00 AM
Jul 12, 2023
CVE Published
via MITRE·11:18 PM
Data Sourced
via MITRE·11:18 PM
DescriptionWeakness
Jul 13, 2023
Data Sourced
12:15 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2023-20918?
CVE-2023-20918 has a moderate severity level due to potential elevation of privilege.
2
How can I fix CVE-2023-20918?
To address CVE-2023-20918, users should apply the latest security updates provided by Google for affected Android versions.
3
What versions of Android are affected by CVE-2023-20918?
CVE-2023-20918 affects Android versions 11.0, 12.0, 12.1, and 13.0.
4
Does CVE-2023-20918 require user interaction to exploit?
No, CVE-2023-20918 can be exploited without any user interaction.
5
What is the nature of the vulnerability in CVE-2023-20918?
CVE-2023-20918 is characterized as a confused deputy vulnerability that allows elevation of privilege.