PT-2023-29116 · Unknown · Lockscreensettings

Published 2023-09-27 · Updated 2023-10-02 · CVE-2023-44122

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LockScreenSettings (affected versions not specified)

Description The issue is related to the theft of arbitrary files with system privilege in the LockScreenSettings app. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. These intents can return arbitrary data that will be passed to the onActivityResult() method. The LockScreenSettings app copies the received file to the "/data/shared/dw/mycategory/wallpaper 01.png" path and then changes the file access mode to world-readable and world-writable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

CWE-927

Related Identifiers

CVE-2023-44122

Affected Products

Lockscreensettings

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-44122 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44122 · Vendor Advisory
• https://lgsecurity.lge.com/bulletins/mobile#updateDetails · Vendor Advisory
• https://t.me/cibsecurity/71075 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1707084720113115262 · Twitter Post
• https://twitter.com/CVEnew/status/1707030690309546283 · Twitter Post