CVE-2023-35680: Medium severity Google Android vulnerability
In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-35680?
CVE-2023-35680 is a vulnerability in multiple locations in Google Android that allows an attacker to import contacts belonging to other users, leading to local information disclosure.
What is the severity of CVE-2023-35680?
The severity of CVE-2023-35680 is high with a severity rating of 5.5.
How can an attacker exploit CVE-2023-35680?
An attacker can exploit CVE-2023-35680 by taking advantage of a confused deputy situation in multiple locations within the Google Android system to import contacts belonging to other users, resulting in local information disclosure.
Who is affected by CVE-2023-35680?
Google Android versions 11.0, 12.0, 12.1, and 13.0 are affected by CVE-2023-35680.
Is user interaction required for exploitation of CVE-2023-35680?
No, user interaction is not needed for exploitation of CVE-2023-35680.