ASB-A-193031925 PUBLISHED CVSS 6.900000095367432 MEDIUM

In multiple functions of ConnectivityService.java, there is a possible way for a Wi-Fi AP to determine what site a device has connected to through a VPN due to side channel information disclosure. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Risk Scores

CVSS v4.0
6.900000095367432
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Products

VendorProductVersions
platformpackages/modules/Connectivity15-next:0, 15-next, 15:0
platformframeworks/libs/net14:0, 14, 14:0

Timeline

References

Open in Interactive Console →