CVE-2023-20963highunder attackCWE-295

CVE-2023-20963: high-severity vulnerability in Android

Published · Updated

Follow this CVE+ Monitor Android

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

73Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 1.5%
from disclosure to weapon80 days
Published on NVDMar 24
1st PoC+80d
CISA KEV+20d
Action required by CISAfederal deadline: 2023-05-04

Apply updates per vendor instructions.

In short

A flaw in WorkSource allows an attacker to cause a mismatch in how data packages are handled, enabling unauthorized privilege escalation on Android devices without needing special permissions or user interaction.

Technical detail

CWE-295 vulnerability in WorkSource service on Android 11-13 permits local privilege escalation through parcel serialization/deserialization mismatch, allowing an unprivileged local process to execute with elevated privileges without user interaction or additional execution capabilities.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Android
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.