Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-44124

The vulnerability is to theft of arbitrary files with system privilege in the Screen recording ("com.lge.gametools.gamerecorder") app in the "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. They also can return arbitrary data that will be passed to the "onActivityResult()" method. The Screen recording app saves contents of arbitrary URIs to SD card which is a world-readable storage.

Published

2023-09-27T15:19:35.903

Last Modified

2024-11-21T08:25:17.683

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.1 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-927
  • Type: Primary
    CWE-668
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System google android 12.0 Yes
Operating System google android 13.0 Yes
Hardware lg v60_thin_q_5g - No
References