CVE-2023-40121: SQL Injection
In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-40121?
CVE-2023-40121 is a vulnerability in the appendEscapedSQLString function of DatabaseUtils.java in Google Android, which allows for a possible SQL injection due to unsafe deserialization.
What is the severity of CVE-2023-40121?
The severity of CVE-2023-40121 is high, with a CVSSv3 score of 5.5.
How can CVE-2023-40121 be exploited?
CVE-2023-40121 can be exploited by local attackers with User execution privileges without requiring user interaction, leading to potential local information disclosure.
What versions of Google Android are affected by CVE-2023-40121?
Google Android versions 11.0, 12.0, 12.1, and 13.0 are affected by CVE-2023-40121.
How can I fix CVE-2023-40121?
To fix CVE-2023-40121, it is recommended to apply the security update provided by Google Android.