Vulnerability in Google Android
CVE-2023-44124
The vulnerability is to theft of arbitrary files with system privilege in the Screen recording ("com.lge.gametools.gamerecorder") app in the "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. They also can return arbitrary data that will be passed to the "onActivityResult()" method. The Screen recording app saves contents of arbitrary URIs to SD card which is a world-readable storage.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.001 (0.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 1st percentile — 0.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000
Affected products
- Google Android — versions 12.0, 13.0
- LG V60 Thin Q 5g
- LG Electronics V60 Thin Q 5g(lmv600vm) — versions Android 12, 13
Weakness classification (CWE)
References
- lgsecurity.lge.com/bulletins/mobile (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-44124?
- CVE-2023-44124 is a medium-severity vulnerability in Google Android, classified under CWE-927. CVSS score: 6.1/10. Published 2023-09-27.
- How severe is CVE-2023-44124?
- Medium severity. CVSS v3 base score is 6.1 out of 10.