Vulnerability · Published Aug 12, 2022 · Assigned by Google

CVE-2022-2390Mutable pending intent in Google Play services SDK

Medium 6.1

In plain English

A medium-severity security flaw in Play Services SDK from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.1%top 98.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.google.android.gms:play-services-basement	18.0.2	GHSA-cm6r-892j-jv2g

Affected products (as reported)

Vendor	Product	Versions
Google LLC	Play Services SDK	unspecified – before 18.0.2

Weakness: CWE-471 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

References

https://developers.google.com/android/guides/releases#may_03_2022 x_refsource_MISC
https://mvnrepository.com/artifact/com.google.android.gms/play-services-basement/18.0.2 x_refsource_MISC