Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-44123

The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Bluetooth ("com.lge.bluetoothsetting") app. The attacker's app, if it had access to app notifications, could intercept them and redirect them to its activity, before making it grant access permissions to content providers with the `android:grantUriPermissions="true"` flag.

Published

2023-09-27T15:19:35.830

Last Modified

2024-11-21T08:25:17.547

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.1 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-285
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System google android 12.0 Yes
Operating System google android 13.0 Yes
Hardware lg v60_thin_q_5g - No
References