CoreCVE
Back

MEDIUM

In broadcastServiceStateChanged of TelephonyRegistry.java, there is a possible way to learn base station information without location permission due to a missing permission check

Published May 10, 2022

Description

In broadcastServiceStateChanged of TelephonyRegistry.java, there is a possible way to learn base station information without location permission due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-210118427

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner google_android
Published May 10, 2022
Updated Aug 3, 2024
Reserved Oct 14, 2021
Link CVE-2022-20115

CISA Vulnrichment

No data

NVD

Status Modified
Modified Jun 17, 2026
Link CVE-2022-20115

Red Hat

No data

ENISA EUVD

Assigner google_android
Published May 10, 2022
Updated Aug 3, 2024
Link EUVD-2022-25375

GitHub

No data