Security readout for executives and security teams
Plain-English summary
CVE-2023-20963 is an Android local privilege escalation issue in WorkSource caused by a possible parcel mismatch. A malicious app or local user with low privileges could gain higher privileges without user interaction. CISA lists it as known exploited, so organizations should treat unpatched affected Android devices as urgent exposure.
Executive priority
High priority. This is a high-impact Android privilege escalation issue with CISA-confirmed known exploitation. Patch or remove affected devices from sensitive access paths quickly, especially where mobile devices handle corporate email, identity, VPN, or administrative workflows.
Technical view
The source describes a WorkSource parcel mismatch affecting Android 11, 12, 12L, and 13. CVSS 3.1 is 7.8: local attack vector, low complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact. Public sources here do not provide deeper root-cause details.
Likely exposure
Exposure is likely on Android 11, 12, 12L, and 13 devices that have not received the relevant March 2023 Android security bulletin fixes or later vendor updates.
Exploitation context
Active exploitation is supported by the CISA Known Exploited Vulnerabilities listing. The provided sources do not describe exploit volume, target sectors, malware families, or public exploit procedures.
Researcher notes
The provided evidence identifies affected Android versions, CVSS attributes, KEV status, and Android bulletin reference. It does not include exploit mechanics, vulnerable code details, vendor-specific patch mapping, or indicators of compromise. Avoid assuming all OEM devices received fixes simultaneously.
Mitigation direction
- Apply applicable Android security updates from March 2023 or later through device vendors or carriers.
- Prioritize enterprise-managed Android 11, 12, 12L, and 13 devices.
- Retire or isolate devices that cannot receive vendor security updates.
- Review CISA KEV remediation deadlines if the organization follows BOD 22-01 requirements.
- Check OEM advisories for model-specific patch availability and update levels.
Validation and detection
- Inventory Android devices by OS version and security patch level.
- Confirm affected devices report a March 2023 or later Android security patch level.
- Verify OEM firmware includes the relevant Android security bulletin fixes.
- Review mobile device management compliance reports for outdated Android builds.
- Monitor endpoint and MDM telemetry for suspicious local privilege escalation indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-295: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-20963 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://source.android.com/security/bulletin/2023-03-01CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20963CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Certificate Validation
Improper Certificate Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.