CVE-2024-23717

EPSS 0.28%
Published 11.03.2024 17:15:46
Last modified 16.12.2024 19:28:06
Source security@android.com
Teams watchlist Login
Open Login

In access_secure_service_from_temp_bond of btm_sec.cc, there is a possible way to achieve keystroke injection due to improper input validation. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Google ≫ Android Version12.0

Google ≫ Android Version12.1

Google ≫ Android Version13.0

Google ≫ Android Version14.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.28%	0.514

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	9.1	3.9	5.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://source.android.com/security/bulletin/2024-03-01

Patch

Vendor Advisory

https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c5c528beb6e1cfed3ec93a3a264084df32ce83c2

Patch

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2024-23717

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-23717

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-23717

EUVD