VDB
CVE-2023-44123
CVE-2023-44123
PUBLISHED
CVSS 6.099999904632568 MEDIUM
The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Bluetooth ("com.lge.bluetoothsetting") app. The attacker's app, if it had access to app notifications, could intercept them and redirect them to its activity, before making it grant access permissions to content providers with the `android:grantUriPermissions="true"` flag.
EPSS 0.13% · 3.0th percentile
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score
0.13%
3.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| android | 13.0, 12.0 | |
| LG Electronics | LG V60 Thin Q 5G(LMV600VM) | Android 12, 13 |
Timeline
- Sep 27, 2023 CVE Published
- Sep 28, 2023 EPSS Score
- Oct 30, 2023 EPSS Score
- Dec 1, 2023 EPSS Score
- Jan 2, 2024 EPSS Score
- Feb 3, 2024 EPSS Score
- Mar 6, 2024 EPSS Score
- Apr 7, 2024 EPSS Score
- May 9, 2024 EPSS Score
- Jun 10, 2024 EPSS Score
- Jul 12, 2024 EPSS Score
- Aug 13, 2024 EPSS Score