PT-2023-17934 · Google · Android

Published 2023-06-01 · Updated 2024-12-17 · CVE-2023-21141

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-11 through Android-13

Description The issue is related to a permissions bypass in several functions of multiple files, allowing access to developer mode traces. This could lead to local information disclosure without requiring additional execution privileges. User interaction is not necessary for exploitation.

Recommendations For Android versions Android-11 through Android-13, consider restricting access to developer mode traces until a patch is available. As a temporary workaround, disabling developer mode may help minimize the risk of exploitation. No specific fix is provided for these versions, so it is essential to wait for an official update from the vendor.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ASB-A-262244249

CVE-2023-21141

Affected Products

Android

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-21141 · Security Note
• https://source.android.com/security/bulletin/2023-06-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-262244249 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-21141 · Vendor Advisory
• https://t.me/cibsecurity/65274 · Telegram Post
• https://t.me/cvenotify/52415 · Telegram Post
• https://android.googlesource.com/platform/packages/apps/Traceur/+/a6c0590c97c7fa8ff78f5d5117a1830c817a107d · Note
• https://t.me/cvenotify/104607 · Telegram Post
• https://t.me/cvenotify/52405 · Telegram Post