Contacts Provider Missing Permission Check Leads to Local Information Disclosure

Executive Summary

This vulnerability exists in the Contacts Provider component where there is a missing permission check that allows access to an incoming call's phone number and related metadata.

Because of this missing permission check, an attacker can locally disclose this information without needing any additional execution privileges or user interaction.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to local information disclosure, meaning that sensitive data such as incoming call phone numbers and associated metadata could be accessed without proper authorization.

Since no additional privileges or user interaction are required, this could allow unauthorized parties to obtain private call information, potentially compromising user privacy.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows local information disclosure of an incoming call's phone number and associated metadata due to a missing permission check in the Contacts Provider. Such unauthorized access to personal data could potentially impact compliance with privacy regulations like GDPR and HIPAA, which require protection of personal and sensitive information.

However, the CVE description does not explicitly mention compliance impacts or regulatory considerations.

Useful 0 Not Useful 0