CVE-2023-40121

MEDIUM

Google Android - Insecure Deserialization

Title source: rule

Description

In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

References (2)

Scores

CVSS v3 5.5
EPSS 0.0012
EPSS Percentile 30.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE
CWE-502
Status published

Affected Products (4)

google/android
google/android
google/android
google/android

Timeline

Published Oct 27, 2023
Tracked Since Feb 18, 2026