PT-2023-29117 · Lg · Com.Lge.Bluetoothsetting

Published 2023-09-27 · Updated 2023-10-02 · CVE-2023-44123

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions com.lge.bluetoothsetting (affected versions not specified)

Description The issue is related to the use of implicit PendingIntents with the PendingIntent.FLAG MUTABLE set, which can lead to the theft and/or over-write of arbitrary files with system privilege in the Bluetooth app. An attacker's app, if it has access to app notifications, can intercept them and redirect them to its activity. This can result in the attacker's app being granted access permissions to content providers with the android:grantUriPermissions="true" flag.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2023-44123

Affected Products

Com.Lge.Bluetoothsetting

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-44123 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44123 · Vendor Advisory
• https://lgsecurity.lge.com/bulletins/mobile#updateDetails · Vendor Advisory
• https://twitter.com/CVEnew/status/1707036097581027661 · Twitter Post