CVE-2022-20214
Last modified
CVE-2022-20214 is a medium-severity vulnerability rated 4.7/10 on the CVSS scale. In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle button to enable apps to modify system settings without user consent.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-183411210. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle button to enable apps to modify system settings without user consent.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-183411210
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Android | 10.0 | |
| Android | 11.0 | |
| Android | 12.0 |
References
- https://source.android.com/security/bulletin/aaos/2023-01-01Vendor Advisory
- https://source.android.com/security/bulletin/aaos/2023-01-01Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-20214?
How severe is CVE-2022-20214?
How do I fix CVE-2022-20214?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-20207In static definitions of GattServiceConfig.java, there is a …7.8
- CVE-2022-20208In parseRecursively of cppbor_parse.cpp, there is a possible…4.4
- CVE-2022-20209In hme_add_new_node_to_a_sorted_array of hme_utils.c, there …7.5
- CVE-2022-20210The UE and the EMM communicate with each other using NAS mes…9.8
- CVE-2022-20212In wifi.RequestToggleWifiActivity of AndroidManifest.xml, th…7.8
- CVE-2022-20213In ApplicationsDetailsActivity of AndroidManifest.xml, there…5.5
- CVE-2022-20215In onCreate of MasterClearConfirmFragment.java, there is a p…5.5
- CVE-2022-20216android exported is used to set third-party app access permi…9.8
- CVE-2022-20217There is a unauthorized broadcast in the SprdContactsProvide…6.5
- CVE-2022-20218In PermissionController, there is a possible way to get and …7.8
- CVE-2022-20219In multiple functions of StorageManagerService.java and User…5.5
- CVE-2022-2022Cross-site Scripting (XSS) - Stored in GitHub repository noc…5.4
Are you affected by CVE-2022-20214?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST