Vulnerability Details : CVE-2020-0473
In updateIncomingFileConfirmNotification of BluetoothOppNotification.java, there is a possible permissions bypass. This could lead to local escalation of privilege allowing an attacker with physical possession of the device to transfer files to it over Bluetooth, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-160691486
Published
2020-12-15 16:15:13
Updated
2020-12-16 18:26:06
Products affected by CVE-2020-0473
- cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-0473
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 18 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-0473
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:N/I:P/A:N |
3.9
|
2.9
|
NIST | |
|
4.6
|
MEDIUM | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
0.9
|
3.6
|
NIST |
CWE ids for CVE-2020-0473
-
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-0473
-
https://source.android.com/security/bulletin/pixel/2020-12-01
Pixel Update Bulletin—December 2020 | Android Open Source ProjectPatch;Vendor Advisory
Jump to