CVE-2022-20399

MEDIUM

Android - Local Information Disclosure via SEPolicy Insecure Default Value

Title source: llm
STIX 2.1

Description

In the SEPolicy configuration of system apps, there is a possible access to the 'ip' utility due to an insecure default value. This could lead to local information disclosure of network data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-219808546References: Upstream kernel

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_misc
https://source.android.com/security/bulletin/2022-09-01

Scores

CVSS v3 5.5
EPSS 0.0009
EPSS Percentile 0.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-732
Status published
Products (1)
google/android
Published Sep 13, 2022
Tracked Since Feb 18, 2026