CVE-2020-27059

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, 11; Android ID: A-159249069.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1021

Affected software

No affected versions have been published.

Timeline

Published: Jan 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-27065.4Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Project CVE-2020-270666.7In xfrm6_tunnel_free_spi of net/ipv6/xfrm6_tunnel.c, there is a possible use after free due to improper locking. This could lead to local es CVE-2020-270676.4In the l2tp subsystem, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with Sys CVE-2020-270689.8Product: AndroidVersions: Android kernelAndroid ID: A-127973231References: Upstream kernel CVE-2020-27075.4Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: WebAcce CVE-2020-27094.7Vulnerability in the Oracle iLearning product of Oracle iLearning (component: Learner Pages). The supported version that is affected is 6.1.CVE-2020-270975.5In checkGrantUriPermission of UriGrantsManagerService.java, there is a possible permissions bypass. This could lead to local information dis CVE-2020-270985.5In checkGrantUriPermission of UriGrantsManagerService.java, there is a possible way to access contacts due to a permissions bypass. This cou CVE-2020-27105.4Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Core). Supported versions that ar CVE-2020-27116.5Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Core). Supported versions that ar CVE-2020-27125.4Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Core). Supported versions that ar CVE-2020-271216.5A vulnerability in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) Software could allow an authenticate