CVEvulnerability
CVE-2023-35683
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-09-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-89
Description
In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected configurations
• google android 11.0
• google android 12.0
• google android 12.1
• google android 13.0
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://android.googlesource.com/platform/packages/providers/MediaProvider/+/23d156ed1bed6d2c2b325f0be540d0afca510c49 Issue Tracking, Patch
- https://source.android.com/security/bulletin/2023-09-01 Vendor Advisory
- https://android.googlesource.com/platform/packages/providers/MediaProvider/+/23d156ed1bed6d2c2b325f0be540d0afca510c49 Issue Tracking, Patch
- https://source.android.com/security/bulletin/2023-09-01 Vendor Advisory