CVE-2023-35670: Path Traversal

Published Sep 5, 2023

Updated

In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' external private directories due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

5 affected components

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android

Remediation

Patch Available

https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db3c69afcb0a45c8aa2f333fcde36217889899fe

Event History

Sep 5, 2023

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Sep 11, 2023

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2023-35670?

CVE-2023-35670 is a vulnerability in the computeValuesFromData function of FileUtils.java in Google Android, which allows for path traversal and potential escalation of privilege.

What is the severity of CVE-2023-35670?

CVE-2023-35670 has a severity level of high (7).

How can CVE-2023-35670 be exploited?

CVE-2023-35670 can be exploited by inserting files into other apps' external private directories through a path traversal error.

Is user interaction required for exploitation of CVE-2023-35670?

No, user interaction is not needed for exploitation of CVE-2023-35670.

How can I fix CVE-2023-35670?

To fix CVE-2023-35670, it is recommended to apply the necessary security patches provided by Google for affected Android versions.