CVE-2022-23835

Katalog CVE

CVSS 8.1 · High EPSS 1,4%

Kerentanan Exposure of Resource to Wrong Sphere pada visual voice mail project visual voice mail. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an application that has the READ_SMS permission, and reads an IMAP credentialing message that is (by design) not displayed to the victim within the AOSP SMS/MMS messaging application. (Often, the IMAP credentials are usable to listen to voice mail messages sent before the vulnerability was exploited, in addition to new ones.) NOTE: some vendors characterize this as not a "concrete and exploitable risk.

Rincian

Terbit di NVD

25 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.kb.cert.org/vuls/id/383864 advisory pihak ketiga · pemerintah AS
• https://gitlab.com/kop316/vvm-disclosure exploit · advisory pihak ketiga