CVE-2023-44125

The vulnerability is the use of implicit PendingIntents without the PendingIntent.FLAG_IMMUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Personalized service ("com.lge.abba") app. The attacker's app, if it had access to app notifications, could intercept them and redirect them to its activity, before making it grant access permissions to content providers with the `android:grantUriPermissions="true"` flag.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lgsecurity.lge.com/bulletins/mobile#updateDetails	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:google:android:12.0:::::::*
	cpe:2.3:o:google:android:13.0:::::::*

cpe:2.3:h:lg:v60_thin_q_5g:-:*:*:*:*:*:*:*

History

02 Oct 2023, 15:36

Type	Values Removed	Values Added
First Time		Lg Lg v60 Thin Q 5g Google Google android
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
CWE		NVD-CWE-noinfo
References	~~(MISC) https://lgsecurity.lge.com/bulletins/mobile#updateDetails -~~	(MISC) https://lgsecurity.lge.com/bulletins/mobile#updateDetails - Vendor Advisory
CPE		cpe:2.3:o:google:android:12.0:::::::* cpe:2.3:h:lg:v60_thin_q_5g:-:::::::* cpe:2.3:o:google:android:13.0:::::::*

27 Sep 2023, 15:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-27 15:19

Updated : 2023-12-10 15:14

NVD link : CVE-2023-44125

Mitre link : CVE-2023-44125

CVE.ORG link : CVE-2023-44125

JSON object : View

Products Affected

lg

v60_thin_q_5g

google

android

CWE

NVD-CWE-noinfo CWE-285

Improper Authorization

{"id": "CVE-2023-44125", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "product.security@lge.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.8}]}, "published": "2023-09-27T15:19:35.980", "references": [{"url": "https://lgsecurity.lge.com/bulletins/mobile#updateDetails", "tags": ["Vendor Advisory"], "source": "product.security@lge.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "product.security@lge.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "The vulnerability is the use of implicit PendingIntents without the PendingIntent.FLAG_IMMUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Personalized service (\"com.lge.abba\") app. The attacker's app, if it had access to app notifications, could intercept them and redirect them to its activity, before making it grant access permissions to content providers with the `android:grantUriPermissions=\"true\"` flag."}, {"lang": "es", "value": "La vulnerabilidad es el uso de PendingIntents impl\u00edcitos sin el conjunto PendingIntent.FLAG_IMMUTABLE que conduce al robo y/o (sobre)escritura de archivos arbitrarios con privilegios del sistema en la aplicaci\u00f3n de servicio personalizado (\"com.lge.abba\"). La aplicaci\u00f3n del atacante, si tuviera acceso a las notificaciones de la aplicaci\u00f3n, podr\u00eda interceptarlas y redirigirlas a su actividad, antes de otorgar permisos de acceso a los proveedores de contenido con el indicador `android:grantUriPermissions=\"true\"`."}], "lastModified": "2023-10-02T15:36:47.867", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8FB8EE9-FC56-4D5E-AE55-A5967634740C"}, {"criteria": "cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "879FFD0C-9B38-4CAA-B057-1086D794D469"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:lg:v60_thin_q_5g:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "85B3B7D2-762E-4DD5-90F9-5246907748C4"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "product.security@lge.com"}