Improper Handling of Unicode Encoding
CVE-2024-43093
Summary
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- LOW
- LOCAL
- HIGH
- UNCHANGED
- REQUIRED
- LOW
- HIGH
- HIGH
CWE-176 - Improper Handling of Unicode Encoding
The software does not properly handle when an input contains Unicode encoding.
References
Advisory Timeline
- Published