Actively exploited · Published Mar 24, 2023 · Assigned by google_android
CVE-2023-20963
High 7.8 Exploited
In plain English
A high-severity improper certificate validation in Android. Attackers are actively exploiting it in the wild (listed by CISA on April 13, 2023). The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 4, 2023.
Official description
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H