Vulnerability · Published Dec 13, 2022 · Assigned by Google
CVE-2022-29580Path Traversal in Android Google Search App
High 8.9
In plain English
A high-severity uncontrolled search path in Android Google Search App from Google. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 3.1)8.9High
Exploit odds (30 days)0.4%top 63.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
There exists a path traversal vulnerability in the Android Google Search app. This is caused by the incorrect usage of uri.getLastPathSegment. A symbolic encoded string can bypass the path logic to get access to unintended directories. An attacker can manipulate paths that could lead to code execution on the device. We recommend upgrading beyond version 13.41
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Android Google Search App | 10.61 – through 13.41 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L