CVE-2023-20909

In multiple functions of RunningTasks.java, there is a possible privilege escalation due to a missing privilege check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-243130512

• CWE-862

• https://source.android.com/security/bulletin/2023-04-01Vendor Advisory
• https://source.android.com/security/bulletin/2023-04-01Vendor Advisory

Published

Apr 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-20902A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 a…6.5
• CVE-2023-20903This disclosure regards a vulnerability related to UAA refre…4.3
• CVE-2023-20904In getTrampolineIntent of SettingsActivity.java, there is a …7.8
• CVE-2023-20905In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a po…7.8
• CVE-2023-20906In onPackageAddedInternal of PermissionManagerService.java, …7.8
• CVE-2023-20908In several functions of SettingsState.java, there is a possi…5.5
• CVE-2023-2091A vulnerability classified as critical was found in KylinSof…7.8
• CVE-2023-20910In add of WifiNetworkSuggestionsManager.java, there is a pos…5.5
• CVE-2023-20911In addPermission of PermissionManagerServiceImpl.java , ther…7.8
• CVE-2023-20912In onActivityResult of AvatarPickerActivity.java, there is a…7.8
• CVE-2023-20913In onCreate of PhoneAccountSettingsActivity.java and related…7.8
• CVE-2023-20914In onSetRuntimePermissionGrantStateByDeviceAdmin of AdminRes…5.5