VULNERABILITY INTELLIGENCE

CVE-2022-20458

CVSS score5.5 MEDIUM
EPSS probability0.12%
CISA KEVNot currently listed
Published2023-01-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey() could contain sensitive information. However, CarNotificationListener.java, it prints out the StatusBarNotification.getKey() directly in logs, which could contain user's account name (i.e. PII), in Android "user" build.Product: AndroidVersions: Android-12LAndroid ID: A-205567776

Weakness classification

  • nvd@nist.gov: CWE-532
  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-532

Primary references