CVE-2019-2197

In processPhonebookAccess of CachedBluetoothDevice.java, there is a possible permission bypass due to an insecure default value. This could lead to local information disclosure of the user's contact list with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-138529441

Score

CVSS 3.1 5.5 Medium

Status

Modified - security@android.com

Published

2019-11-13

Last modified

2024-08-04

Weaknesses

CWE-1188

Affected products

• Android (Google)

References

• https://source.android.com/security/bulletin/2019-11-01