PT-2023-27231 · Google · Android

Published 2023-09-10 · Updated 2023-09-13 · CVE-2023-40040

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MyCrops HiGrade "THC Testing & Cannabi" application version 1.0.337

Description An issue was discovered in the MyCrops HiGrade "THC Testing & Cannabi" application for Android, where a remote attacker can start the camera feed via the com.cordovaplugincamerapreview.CameraActivity component in some situations. This issue is only exploitable on Android versions that lack runtime permission checks, specifically Android SDK 5.1.1 API 22, which applies to Android Lollipop. It affects less than five percent of Android devices as of 2023.

Recommendations As a temporary workaround, consider disabling the com.cordovaplugincamerapreview.CameraActivity component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-40040

Affected Products

Android

References · 7

• 🔥 https://github.com/actuator/cve/blob/main/CVE-2023-40040 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-40040 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40040 · Vendor Advisory
• https://t.me/cibsecurity/70197 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1701184966556528788 · Twitter Post
• https://twitter.com/CVEnew/status/1701118465451643106 · Twitter Post
• https://t.me/cvenotify/57921 · Telegram Post