github - ghsa-v2jq-h62v-wr47

ghsa-v2jq-h62v-wr47

Vulnerability from github

Published

2022-05-24 17:38

Modified

2022-05-24 17:38

Details

In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, 11; Android ID: A-159249069.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2020-27059"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-01-11T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user\u0027s fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, 11; Android ID: A-159249069.",
  "id": "GHSA-v2jq-h62v-wr47",
  "modified": "2022-05-24T17:38:34Z",
  "published": "2022-05-24T17:38:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27059"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/pixel/2021-01-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

cve-2020-27059

Vulnerability from cvelistv5

Published

2021-01-11 20:28

Modified

2024-08-04 16:11

Severity

Summary

In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, 11; Android ID: A-159249069.

References

URL	Tags
https://source.android.com/security/bulletin/pixel/2021-01-01	x_refsource_CONFIRM

Impacted products

Vendor	Product
n/a	Android

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:11:35.475Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://source.android.com/security/bulletin/pixel/2021-01-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Android",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Android-8.0"
            },
            {
              "status": "affected",
              "version": "Android-8.1"
            },
            {
              "status": "affected",
              "version": "Android-9"
            },
            {
              "status": "affected",
              "version": "Android-10 and 11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user\u0027s fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, 11; Android ID: A-159249069."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-11T20:28:56",
        "orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
        "shortName": "google_android"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://source.android.com/security/bulletin/pixel/2021-01-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@android.com",
          "ID": "CVE-2020-27059",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Android",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Android-8.0"
                          },
                          {
                            "version_value": "Android-8.1"
                          },
                          {
                            "version_value": "Android-9"
                          },
                          {
                            "version_value": "Android-10 and 11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user\u0027s fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, 11; Android ID: A-159249069."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Elevation of privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://source.android.com/security/bulletin/pixel/2021-01-01",
              "refsource": "CONFIRM",
              "url": "https://source.android.com/security/bulletin/pixel/2021-01-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
    "assignerShortName": "google_android",
    "cveId": "CVE-2020-27059",
    "datePublished": "2021-01-11T20:28:56",
    "dateReserved": "2020-10-12T00:00:00",
    "dateUpdated": "2024-08-04T16:11:35.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.