CVE-2024-34721

EPSS 0.03%
Veröffentlicht 09.07.2024 21:15:14
Zuletzt bearbeitet 17.12.2024 18:17:31
Quelle security@android.com
Teams Watchlist Login
Unerledigt Login

In ensureFileColumns of MediaProvider.java, there is a possible disclosure of files owned by another user due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Google ≫ Android Version12.0

Google ≫ Android Version12.1

Google ≫ Android Version13.0

Google ≫ Android Version14.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.03%	0.064

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.5	1.8	3.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.2	2.5	3.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-922 Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

https://source.android.com/security/bulletin/2024-07-01

Patch

Vendor Advisory

https://android.googlesource.com/platform/packages/providers/MediaProvider/+/7a1cbf5a8e17e6bff7c835fdd30dcc42b681db0a

Patch

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2024-34721

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-34721

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-34721

EUVD