CVE-2024-0015

In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection

High · published February 16, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
30.4
In the wild
Unconfirmed
What it is

In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00376 · 30.4th percentile
Published
2024-02-16T18:33Z
EPSS history
Timeline
  • 16 FEB 18:33Z
    In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection
    cvelistv5