CVE-2022-20493

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Condition of Condition.java, there is a possible way to grant notification access due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242846316

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1284

Affected software

Vendor	Product	Versions
n/a	Android	Android-10 Android-11 Android-12 Android-12L Android-13

References

https://source.android.com/security/bulletin/2023-01-01Vendor Advisory
https://source.android.com/security/bulletin/2023-01-01Vendor Advisory

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-204945.5In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. This could lead to local denial CVE-2022-204957.8In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility service due to a logic CVE-2022-204965.5In setDataSource of initMediaExtractor.cpp, there is a possibility of arbitrary code execution due to a use after free. This could lead to l CVE-2022-204974.6In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifications on the lockscre CVE-2022-204984.4In fdt_path_offset_namelen of fdt_ro.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local in CVE-2022-204995.5In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to local persistent denial CVE-2022-20504.8The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored CVE-2022-205005.5In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead to local denial of s CVE-2022-205017.3In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account due CVE-2022-205025.5In GetResolvedMethod of entrypoint_utils-inl.h, there is a possible use after free due to a stale cache. This could lead to local informatio CVE-2022-205037.8In onCreate of WifiDppConfiguratorActivity.java, there is a possible way for a guest user to add a WiFi configuration due to a missing permi CVE-2022-205046.7In multiple locations of DreamManagerService.java, there is a missing permission check. This could lead to local escalation of privilege and