CVE-2022-29580 Vulnerability Details

  /     /     /  

CVE-2022-29580 Metadata Quick Info

CVE Published: 13/12/2022 | CVE Updated: 03/08/2024 | CVE Year: 2022
Source: Google | Vendor: Google | Product: Android Google Search App
Status : PUBLISHED

---

CVE-2022-29580 Description

There exists a path traversal vulnerability in the Android Google Search app. This is caused by the incorrect usage of uri.getLastPathSegment. A symbolic encoded string can bypass the path logic to get access to unintended directories. An attacker can manipulate paths that could lead to code execution on the device. We recommend upgrading beyond version 13.41

Metrics

CVSS Version: 3.1 | Base Score: 8.9 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* LOW
    User Interaction (UI)* REQUIRED
    Scope (S)* CHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* LOW

Weakness Enumeration (CWE)

CWE-ID: CWE-427
CWE Name: CWE-427 Uncontrolled Search Path Element
Source: Google

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-126
CAPEC Description: CAPEC-126 Path Traversal


Source: NVD (National Vulnerability Database).