CVE-2021-0933
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consent dialog due to improper input validation. This could lead to remote escalation of privilege, confusing the user into accepting pairing of a malicious Bluetooth device, with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-172251622
En la función onCreate del archivo CompanionDeviceActivity.java o DeviceChooserActivity.java, es posible que las etiquetas HTML interfieran con un diálogo de consentimiento debido a una comprobación de entrada inapropiada. Esto podría conllevar a una escalada remota de privilegios, confundiendo al usuario para que acepte el emparejamiento de un dispositivo Bluetooth malicioso, sin ser necesarios privilegios de ejecución adicionales. Es requerida una interacción del usuario para su explotación. Producto: Android. Versiones: Android-10 Android-11 Android-12 Android-9. ID de Android: A-172251622
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-11-06 CVE Reserved
- 2021-12-15 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
- CWE-116: Improper Encoding or Escaping of Output
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://source.android.com/security/bulletin/2021-11-01 | 2023-08-08 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | 9.0 Search vendor "Google" for product "Android" and version "9.0" | - |
Affected
| ||||||
Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | 10.0 Search vendor "Google" for product "Android" and version "10.0" | - |
Affected
| ||||||
Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | 11.0 Search vendor "Google" for product "Android" and version "11.0" | - |
Affected
| ||||||
Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | 12.0 Search vendor "Google" for product "Android" and version "12.0" | - |
Affected
|