CVE-2022-20499

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-246539931

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
n/a	Android	Android-12 Android-12L Android-13

References

https://source.android.com/security/bulletin/2023-03-01Patch, Vendor Advisory
https://source.android.com/security/bulletin/2023-03-01Patch, Vendor Advisory

Timeline

Published: Mar 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-20504.8The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored CVE-2022-205005.5In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead to local denial of s CVE-2022-205017.3In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account due CVE-2022-205025.5In GetResolvedMethod of entrypoint_utils-inl.h, there is a possible use after free due to a stale cache. This could lead to local informatio CVE-2022-205037.8In onCreate of WifiDppConfiguratorActivity.java, there is a possible way for a guest user to add a WiFi configuration due to a missing permi CVE-2022-205046.7In multiple locations of DreamManagerService.java, there is a missing permission check. This could lead to local escalation of privilege and CVE-2022-205056.7In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. This could lead to local escalatio CVE-2022-205067.8In onCreate of WifiDialogActivity.java, there is a missing permission check. This could lead to local escalation of privilege from a guest u CVE-2022-205077.8In onMulticastListUpdateNotificationReceived of UwbEventManager.java, there is a possible arbitrary code execution due to a missing bounds c CVE-2022-205087.8In onAttach of ConfigureWifiSettings.java, there is a possible way for a guest user to change WiFi settings due to a permissions bypass. Thi CVE-2022-205096.7In mapGrantorDescr of MessageQueueBase.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local es CVE-2022-205105.5In getNearbyNotificationStreamingPolicy of DevicePolicyManagerService.java, there is a possible way to learn about the notification streamin