CVE-2022-20499
Last modified
CVE-2022-20499 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-246539931. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-246539931
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Android | 12.0 | |
| Android | 12.1 | |
| Android | 13.0 |
References
- https://source.android.com/security/bulletin/2023-03-01Patch, Vendor Advisory
- https://source.android.com/security/bulletin/2023-03-01Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-20499?
How severe is CVE-2022-20499?
How do I fix CVE-2022-20499?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-20493In Condition of Condition.java, there is a possible way to g…7.8
- CVE-2022-20494In AutomaticZenRule of AutomaticZenRule.java, there is a pos…5.5
- CVE-2022-20495In getEnabledAccessibilityServiceList of AccessibilityManage…7.8
- CVE-2022-20496In setDataSource of initMediaExtractor.cpp, there is a possi…5.5
- CVE-2022-20497In updatePublicMode of NotificationLockscreenUserManagerImpl…4.6
- CVE-2022-20498In fdt_path_offset_namelen of fdt_ro.c, there is a possible …4.4
- CVE-2022-2050The WP-Paginate WordPress plugin before 2.1.9 does not escap…4.8
- CVE-2022-20500In loadFromXml of ShortcutPackage.java, there is a possible …5.5
- CVE-2022-20501In onCreate of EnableAccountPreferenceActivity.java, there i…7.3
- CVE-2022-20502In GetResolvedMethod of entrypoint_utils-inl.h, there is a p…5.5
- CVE-2022-20503In onCreate of WifiDppConfiguratorActivity.java, there is a …7.8
- CVE-2022-20504In multiple locations of DreamManagerService.java, there is …6.7
Are you affected by CVE-2022-20499?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST