CVE-2022-20004

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In checkSlicePermission of SliceManagerService.java, it is possible to access any slice URI due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-179699767

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: May 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-200057.8In validateApkInstallLocked of PackageInstallerSession.java, there is a way to force a mismatch between running code and a parsed APK . This CVE-2022-200067.0In several functions of KeyguardServiceWrapper.java and related files,, there is a possible way to briefly view what's under the lockscreen CVE-2022-200077.0In startActivityForAttachedApplicationIfNeeded of RootWindowContainer.java, there is a possible way to overlay an app that believes it's sti CVE-2022-200084.6In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local in CVE-2022-200096.8In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing bounds check. This could lead to CVE-2022-20018.8The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to CVE-2022-200106.5In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote CVE-2022-200115.5In getArray of NotificationManagerService.java , there is a possible leak of one user notifications to another due to missing check. This co CVE-2022-200127.8In mdp driver, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with no ad CVE-2022-200136.4In vow driver, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System e CVE-2022-200146.7In vow driver, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with CVE-2022-200154.4In kd_camera_hw driver, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosur