Vulnerability in Google Android
CVE-2023-44124
The vulnerability is to theft of arbitrary files with system privilege in the Screen recording ("com.lge.gametools.gamerecorder") app in the "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. They also can return arbitrary data that will be passed to the "onActivityResult()" method. The Screen recording app saves contents of arbitrary URIs to SD card which is a world-readable storage.
EPSS: 0.001 (0.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.
Affected products
- Google Android — versions 12.0, 13.0
- Lg V60_thin_q_5g
- Lg Electronics V60 Thin Q 5g(lmv600vm) — versions Android 12, 13
Weakness classification (CWE)
References
- product.security@lge.com (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-44124?
- CVE-2023-44124 is a medium-severity vulnerability in Google Android, classified under CWE-927. CVSS score: 6.1/10. Published 2023-09-27.
- How severe is CVE-2023-44124?
- Medium severity. CVSS v3 base score is 6.1 out of 10.