CVEvulnerability

CVE-2023-21270

7.8 HIGH Published 2024-11-19 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-11-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-276, CWE-863

Description

In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect permission flags cleared during an update. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

Affected configurations

• google android 12.0 • google android 12.1 • google android 13.0

Related

Weakness · CWE (2)

  • CWE-276 Incorrect Default Permissions weakness
  • CWE-863 Incorrect Authorization weakness

References