CVE-2022-20249

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-226900861

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-203

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-20259.8an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check theCVE-2022-202507.8In Messaging, there is a possible way to attach files to a message without proper access checks due to improper input validation. This couldCVE-2022-202513.3In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatiCVE-2022-202523.3In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatCVE-2022-202536.5In Bluetooth, there is a possible cleanup failure due to an uncaught exception. This could lead to remote denial of service in Bluetooth witCVE-2022-202548.8In Wi-Fi, there is a permissions bypass. This could lead to local escalation of privilege from the guest user with no additional execution pCVE-2022-202554.4In SettingsProvider, there is a possible way to read or change the default ringtone due to a missing permission check. This could lead to loCVE-2022-202566.4In the Audio HAL, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with SysCVE-2022-202573.3In Bluetooth, there is a possible way to pair a display only device without PIN confirmation due to a logic error in the code. This could leCVE-2022-202587.8In Bluetooth, there is a possible way to bypass compiler exploit mitigations due to a configuration error. This could lead to local escalatiCVE-2022-202595.5In Telephony, there is a possible leak of ICCID and EID due to a missing permission check. This could lead to local information disclosure wCVE-2022-20265.4Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0.
CVE-2022-20249: Low severity, CVSS 3.3 | Vulnix