CVE-2023-44127 (GCVE-0-2023-44127)

Vulnerability from cvelistv5 – Published: 2023-09-27 14:05 – Updated: 2024-09-20 19:46
VLAI?
Title
Call management - Implicit activity intents disclose contact details and phone numbers
Summary
he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers.
Severity ?
3.6 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CWE
  • CWE-927 - Use of Implicit Intent for Sensitive Communication
Assigner
LGE
References
Impacted products
Vendor Product Version
LG Electronics LG V60 Thin Q 5G(LMV600VM) Affected: Android 8 , ≤ 13 (Android)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:59:50.998Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lgsecurity.lge.com/bulletins/mobile#updateDetails"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44127",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T18:14:19.419341Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T19:46:53.170Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LG V60 Thin Q 5G(LMV600VM)",
          "vendor": "LG Electronics",
          "versions": [
            {
              "lessThanOrEqual": "13",
              "status": "affected",
              "version": "Android 8",
              "versionType": "Android"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "he vulnerability is that the Call management (\"com.android.server.telecom\") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers."
            }
          ],
          "value": "he vulnerability is that the Call management (\"com.android.server.telecom\") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-927",
              "description": "CWE-927 Use of Implicit Intent for Sensitive Communication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-27T14:05:24.523Z",
        "orgId": "42f21055-226c-4bce-a3c8-ecf55a3551fb",
        "shortName": "LGE"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lgsecurity.lge.com/bulletins/mobile#updateDetails"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Call management - Implicit activity intents disclose contact details and phone numbers",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42f21055-226c-4bce-a3c8-ecf55a3551fb",
    "assignerShortName": "LGE",
    "cveId": "CVE-2023-44127",
    "datePublished": "2023-09-27T14:05:24.523Z",
    "dateReserved": "2023-09-26T05:57:13.719Z",
    "dateUpdated": "2024-09-20T19:46:53.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:google:android:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0\", \"versionEndIncluding\": \"13.0\", \"matchCriteriaId\": \"D4E21776-A17F-44D5-AF8F-4BC3806BE6B4\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:lg:v60_thin_q_5g:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"85B3B7D2-762E-4DD5-90F9-5246907748C4\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"he vulnerability is that the Call management (\\\"com.android.server.telecom\\\") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers.\"}, {\"lang\": \"es\", \"value\": \"La vulnerabilidad es que la aplicaci\\u00f3n de administraci\\u00f3n de Llamadas (\\\"com.android.server.telecom\\\") parcheada por LG lanza intenciones impl\\u00edcitas que revelan datos sensibles a todas las aplicaciones de terceros instaladas en el mismo dispositivo. Esas intenciones incluyen datos como detalles de contacto y n\\u00fameros de tel\\u00e9fono.\"}]",
      "id": "CVE-2023-44127",
      "lastModified": "2024-11-21T08:25:18.113",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"product.security@lge.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N\", \"baseScore\": 3.6, \"baseSeverity\": \"LOW\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2023-09-27T15:19:37.067",
      "references": "[{\"url\": \"https://lgsecurity.lge.com/bulletins/mobile#updateDetails\", \"source\": \"product.security@lge.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://lgsecurity.lge.com/bulletins/mobile#updateDetails\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "product.security@lge.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"product.security@lge.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-927\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-44127\",\"sourceIdentifier\":\"product.security@lge.com\",\"published\":\"2023-09-27T15:19:37.067\",\"lastModified\":\"2024-11-21T08:25:18.113\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"he vulnerability is that the Call management (\\\"com.android.server.telecom\\\") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers.\"},{\"lang\":\"es\",\"value\":\"La vulnerabilidad es que la aplicaci\u00f3n de administraci\u00f3n de Llamadas (\\\"com.android.server.telecom\\\") parcheada por LG lanza intenciones impl\u00edcitas que revelan datos sensibles a todas las aplicaciones de terceros instaladas en el mismo dispositivo. Esas intenciones incluyen datos como detalles de contacto y n\u00fameros de tel\u00e9fono.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"product.security@lge.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N\",\"baseScore\":3.6,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"product.security@lge.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-927\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:google:android:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0\",\"versionEndIncluding\":\"13.0\",\"matchCriteriaId\":\"D4E21776-A17F-44D5-AF8F-4BC3806BE6B4\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:lg:v60_thin_q_5g:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"85B3B7D2-762E-4DD5-90F9-5246907748C4\"}]}]}],\"references\":[{\"url\":\"https://lgsecurity.lge.com/bulletins/mobile#updateDetails\",\"source\":\"product.security@lge.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://lgsecurity.lge.com/bulletins/mobile#updateDetails\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lgsecurity.lge.com/bulletins/mobile#updateDetails\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T19:59:50.998Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-44127\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-20T18:14:19.419341Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-20T19:46:46.771Z\"}}], \"cna\": {\"title\": \"Call management - Implicit activity intents disclose contact details and phone numbers\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-122\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-122 Privilege Abuse\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 3.6, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"LG Electronics\", \"product\": \"LG V60 Thin Q 5G(LMV600VM)\", \"versions\": [{\"status\": \"affected\", \"version\": \"Android 8\", \"versionType\": \"Android\", \"lessThanOrEqual\": \"13\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lgsecurity.lge.com/bulletins/mobile#updateDetails\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"he vulnerability is that the Call management (\\\"com.android.server.telecom\\\") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"he vulnerability is that the Call management (\\\"com.android.server.telecom\\\") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-927\", \"description\": \"CWE-927 Use of Implicit Intent for Sensitive Communication\"}]}], \"providerMetadata\": {\"orgId\": \"42f21055-226c-4bce-a3c8-ecf55a3551fb\", \"shortName\": \"LGE\", \"dateUpdated\": \"2023-09-27T14:05:24.523Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-44127\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-20T19:46:53.170Z\", \"dateReserved\": \"2023-09-26T05:57:13.719Z\", \"assignerOrgId\": \"42f21055-226c-4bce-a3c8-ecf55a3551fb\", \"datePublished\": \"2023-09-27T14:05:24.523Z\", \"assignerShortName\": \"LGE\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.