7.3

CVE-2021-0583

EPSS 0.01%
Veröffentlicht 11.10.2021 16:15:07
Zuletzt bearbeitet 21.11.2024 05:42:58
Quelle security@android.com
CVE-Watchlists
Login
Unerledigt
Login

In onCreate of BluetoothPairingDialog, there is a possible way to enable Bluetooth without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-182282956

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 2 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Google ≫ Android Version9.0

Google ≫ Android Version10.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.01%	0.018

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.3	1.3	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov	4.4	3.4	6.4	AV:L/AC:M/Au:N/C:P/I:P/A:P

CWE-1021 Improper Restriction of Rendered UI Layers or Frames

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

https://source.android.com/security/bulletin/aaos/2021-10-01

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2021-0583

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-0583

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-0583

EUVD