CVE-2023-21171 - In verifyInputEvent of InputDispatcher.cpp, there is a possible way to conduct click fraud due to side channel information disclosure · CoreCVE

Back Back to CVE browser

MEDIUM

In verifyInputEvent of InputDispatcher.cpp, there is a possible way to conduct click fraud due to side channel information disclosure

Published Jun 28, 2023

6.7

MEDIUM

CVSS 3.1

EPSS 0.10%

Description

In verifyInputEvent of InputDispatcher.cpp, there is a possible way to conduct click fraud due to side channel information disclosure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-261085213

Affected products

Vendor n/a Product Android Default
unknown
Affected
- Android-13

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Android	unknown	Affected Android-13

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-25339
Advisory
https://source.android.com/security/bulletin/pixel/2023-06-01
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-25339		Advisory
https://source.android.com/security/bulletin/pixel/2023-06-01		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner google_android

Published Jun 28, 2023

Updated Dec 4, 2024

Reserved Nov 3, 2022

Link CVE-2023-21171

CISA Vulnrichment

Updated Dec 4, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-21171

Red Hat

No data

ENISA EUVD

Assigner google_android

Published Jun 28, 2023

Updated Dec 4, 2024

Link EUVD-2023-25339

GitHub

No data