8.8high
CVE-2019-2003
In addLinks of Linkify.java, there is a possible phishing vector due to an unusual root cause.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.4%
percentile 72%
Public exploits
0
none known
Summary
In addLinks of Linkify.java, there is a possible phishing vector due to an unusual root cause. This could lead to remote code execution or misdirection of clicks with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-116321860
Exploit prediction (EPSS)
1.37% probability of exploitation in the next 30 days, higher than 72% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- n/a Android
Classification
- Weakness
- CWE-264 Permissions, Privileges, and Access Controls
References
- source.android.com /security/bulletin/2019-03-01 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2019-2003
- NVD: CVE-2019-2003
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.