PT-2023-7531 · Google · Android

CVE-2023-40076 · Publicado 2023-12-01 · Atualizado 2024-02-02

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description The issue is related to the createPendingIntent function in CredentialManagerUi.java, which lacks protection of service data. This could allow an attacker to access credentials from other users due to a permissions bypass, leading to local escalation of privilege without needing additional execution privileges. User interaction is not required for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Incorrect Default Permissions

Information Disclosure

Incorrect Privilege Assignment

Enumeração de Fraquezas

CWE-284

CWE-276

CWE-200

CWE-266

Identificadores relacionados

ASB-A-303835719

BDU:2023-08585

CVE-2023-40076

Produtos afetados

Android

Referências · 12

• https://android.googlesource.com/platform/frameworks/base/+/9b68987df85b681f9362a3cadca6496796d23bbc · Correção
• https://media.defense.gov/2024/Oct/09/2003562611/-1/-1/0/CSA-UPDATE-ON-SVR-CYBER-OPS.PDF · Nota
• https://source.android.com/security/bulletin/2023-12-01 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-08585 · Nota de Segurança
• https://t.me/cvenotify/62976 · Publicação no Telegram
• https://vuldb.com/?id.246892 · Nota
• https://twitter.com/CVEnew/status/1731808762560737353 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-40076 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-40076 · Nota de Segurança
• https://osv.dev/vulnerability/ASB-A-303835719 · Aviso do Fabricante
• https://t.me/true_secator/5162 · Publicação no Telegram
• https://twitter.com/xvonfers/status/1731746111113527804 · Publicação no Twitter