Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2023-44125

Personalized service - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
LGE

Description

The vulnerability is the use of implicit PendingIntents without the PendingIntent.FLAG_IMMUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Personalized service ("com.lge.abba") app. The attacker's app, if it had access to app notifications, could intercept them and redirect them to its activity, before making it grant access permissions to content providers with the `android:grantUriPermissions="true"` flag.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

LG Electronics LG V60 Thin Q 5G(LMV600VM)

Default version status: unaffected

  • Android 12, 13affected

References