CVE-2023-20953

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to bypass factory reset protection due to incorrect UI being shown prior to setup completion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251778420

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Mar 24, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-209549.8In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code eCVE-2023-209557.8In onPrepareOptionsMenu of AppInfoDashboardFragment.java, there is a possible way to bypass admin restrictions and uninstall applications foCVE-2023-209564.4In Import of C2SurfaceSyncObj.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local informatiCVE-2023-209577.8In onAttach of SettingsPreferenceFragment.java, there is a possible bypass of Factory Reset Protections due to a confused deputy. This couldCVE-2023-209587.1In read_paint of ttcolr.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information discloCVE-2023-209597.8In AddSupervisedUserActivity, guest users are not prevented from starting the activity due to missing permissions checks. This could lead toCVE-2023-20969.8A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been classified as critical. Affected is an unknowCVE-2023-209608.8In launchDeepLinkIntentToRight of SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities due to improper inpuCVE-2023-209625.5In getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from the background due to CVE-2023-209637.8In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-209647.8In multiple functions of MediaSessionRecord.java, there is a possible Intent rebroadcast due to a confused deputy. This could lead to local CVE-2023-209659.8In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. T
CVE-2023-20953: High severity, CVSS 7.8 | Vulnix