In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a third party app due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Metrics
Affected Vendors & Products
References
History
Wed, 18 Dec 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Google
Google android |
|
Weaknesses | NVD-CWE-Other | |
CPEs | cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:* cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:* |
|
Vendors & Products |
Google
Google android |
Thu, 14 Nov 2024 16:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Weaknesses | CWE-276 | |
Metrics |
cvssV3_1
|
Wed, 13 Nov 2024 17:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a third party app due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | |
References |
|
MITRE
Status: PUBLISHED
Assigner: google_android
Published: 2024-11-13T17:25:13.382Z
Updated: 2024-11-14T15:16:02.013Z
Reserved: 2024-08-05T14:29:42.343Z
Link: CVE-2024-43086
Vulnrichment
Updated: 2024-11-14T15:15:54.599Z
NVD
Status : Analyzed
Published: 2024-11-13T18:15:21.240
Modified: 2024-12-18T16:58:17.253
Link: CVE-2024-43086
Redhat
No data.