CVE-2021-23244

2021-12-2718:48:24

OPPO

www.cve.org

coloros

dangerous permissions

whitelist xml

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

28.0%

JSON

ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelist is not installed, attacker can disguise app with the same package name to obtain dangerous permission.

CNA Affected

[
  {
    "product": "OPPO Android Phone",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "OPPO Mobile phones with ColorOS 11 version"
      }
    ]
  }
]

References

security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1474214753353342976