CVE-2024-49722
BaseFortify
Publication date: 2025-09-02
Last updated on: 2025-09-04
Assigner: Android (associated with Google Inc. or Open Handset Alliance)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| android | 15.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-610 | The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the showAvatarPicker method of EditUserPhotoController.java, where a confused deputy issue can cause a cross user image leak. This means that images from one user could be accessed by another user without proper authorization. Exploiting this vulnerability does not require any additional execution privileges or user interaction.
How can this vulnerability impact me? :
This vulnerability can lead to local information disclosure, where images belonging to one user might be exposed to another user on the same device. This could compromise user privacy by leaking personal images without needing extra permissions or user actions.