CVE-2022-2390 (CNNVD-202208-2833)
中文标题:
Google Play services 安全漏洞
英文标题:
Mutable pending intent in Google Play services SDK
漏洞描述
中文描述:
Google Play services是美国谷歌（Google）公司的用于更新 Google 应用和 Google Play 提供的其他应用。 Google Play Services SDK存在安全漏洞，该漏洞源于应用程序错误地将可变性标志设置为 PendingIntents 并传递给通知服务。
英文描述:
Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Google LLC | Play Services SDK | - | < 18.0.2 | - |
cpe:2.3:a:google_llc:play_services_sdk:*:*:*:*:*:*:*:*
|
| google_play_services_software_development_kit | * | - | - |
cpe:2.3:a:google:google_play_services_software_development_kit:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2022-2390 |
2025-11-11 15:21:25 | 2025-11-11 07:37:20 |
| NVD | nvd_CVE-2022-2390 |
2025-11-11 14:58:22 | 2025-11-11 07:45:37 |
| CNNVD | cnnvd_CNNVD-202208-2833 |
2025-11-11 15:10:58 | 2025-11-11 07:57:26 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202208-2833
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']