Every CVESearch/Get API key

CVE-2020-0107

In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to...

5.5 MediumFix available

CVE-2020-0107 is a medium vulnerability (CVSS 5.5) in Google Android, published July 1, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 3rd percentile. Fixed in platform/packages/services/Telephony 10:2020-07-01.

What does this mean?
Severity
5.5 MediumCVSS 3.1, NVD
Exploit chance
0.15%EPSS, 3rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
10:2020-07-01platform/packages/services/Telephony

Description

In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146570216

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.15%Unchanged since Apr 14, 2021
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
platform/packages/services/Telephony
Android
10:0 up to 10:2020-07-01, plus listed versions
10
10:2020-07-01

What each source reports

NVD Score used5.5

In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146570216

Record
CVE-2020-0107
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-862
Updated
2026-11-02
CVE ListNo score

In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146570216

Record
CVE-2020-0107
Updated
2026-11-02
EUVDEUVD-2020-1613No score

In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146570216

Record
EUVD-2020-1613
Updated
2026-11-03
GitHub AdvisoriesGHSA-4qqg-r6qm-rxghNo score

In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to...

In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146570216

Record
GHSA-4qqg-r6qm-rxgh
Weakness
CWE-276
Updated
2026-11-02
OSVASB-A-146570216No score

In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Record
ASB-A-146570216
Updated
2026-11-10

History

History
RecordedChangedSources
factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open