Skip to main content

Improper Handling of Unicode Encoding

CVE-2024-43093

Severity High
Score 7.3/10

Summary

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

  • LOW
  • LOCAL
  • HIGH
  • UNCHANGED
  • REQUIRED
  • LOW
  • HIGH
  • HIGH

CWE-176 - Improper Handling of Unicode Encoding

The software does not properly handle when an input contains Unicode encoding.

References

Advisory Timeline

  • Published