VDB
CVE-2022-23835
CVE-2022-23835
PUBLISHED
CVSS 4.300000190734863 MEDIUM
The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an application that has the READ_SMS permission, and reads an IMAP credentialing message that is (by design) not displayed to the victim within the AOSP SMS/MMS messaging application. (Often, the IMAP credentials are usable to listen to voice mail messages sent before the vulnerability was exploited, in addition to new ones.) NOTE: some vendors characterize this as not a "concrete and exploitable risk.
EPSS 0.36% · 58.6th percentile
Risk Scores
CVSS 2.0
4.300000190734863
EPSS Score
0.36%
58.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| visual_voice_mail_project | visual_voice_mail | 0 |
Timeline
- Feb 25, 2022 EPSS Score
- Feb 25, 2022 CVE Published
- Apr 18, 2022 EPSS Score
- Jun 9, 2022 EPSS Score
- Aug 1, 2022 EPSS Score
- Sep 21, 2022 EPSS Score
- Nov 12, 2022 EPSS Score
- Jan 3, 2023 EPSS Score
- Feb 24, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 17, 2023 EPSS Score
- Jun 8, 2023 EPSS Score