CVE-2023-35683: SQL Injection
Published Sep 5, 2023
·Updated
In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
5 affected components
Google Android=11.0
Google Android=12.0
Google Android=12.1
Google Android=13.0
Google Android
Remediation
Event History
Sep 5, 2023
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Sep 11, 2023
CVE Published
via MITRE·08:09 PM
Data Sourced
via MITRE·08:09 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-35683?
The severity of CVE-2023-35683 is high.
2
How does CVE-2023-35683 allow access to files from other applications?
CVE-2023-35683 allows access to files from other applications through SQL injection in the bindSelection function of DatabaseUtils.java.
3
Is user interaction required for exploitation of CVE-2023-35683?
No, user interaction is not needed for exploitation of CVE-2023-35683.
4
What is the affected software for CVE-2023-35683?
The affected software for CVE-2023-35683 is Google Android versions 11.0, 12.0, 12.1, and 13.0.
5
How can I fix CVE-2023-35683?
To fix CVE-2023-35683, it is recommended to apply the security patches provided by Google for the affected Android versions.