[ CVE-2023-20963 · Published 24 Mar 2023 ]

Android Framework Privilege Escalation Vulnerability

Exploited · CISA KEV CVSS 7.8 EPSS 1%Fix available

[ Why it matters ]Priority signals

Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-04-13

[ Description ]Official description

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519

CISA: Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 4 May 2023): Apply updates per vendor instructions.

Patch on source.android.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

source.android.com/security/bulletin/2023-03-01PatchVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalogThird Party AdvisoryUS Government Resource