PT-2023-7531 · Google · Android

Published 2023-12-01 · Updated 2024-02-02 · CVE-2023-40076

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description The issue is related to the createPendingIntent function in CredentialManagerUi.java, which lacks protection of service data. This could allow an attacker to access credentials from other users due to a permissions bypass, leading to local escalation of privilege without needing additional execution privileges. User interaction is not required for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Incorrect Default Permissions

Information Disclosure

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-276

CWE-200

CWE-266

Related Identifiers

ASB-A-303835719

BDU:2023-08585

CVE-2023-40076

Affected Products

Android

References · 12

• https://android.googlesource.com/platform/frameworks/base/+/9b68987df85b681f9362a3cadca6496796d23bbc · Patch
• https://source.android.com/security/bulletin/2023-12-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08585 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40076 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40076 · Security Note
• https://osv.dev/vulnerability/ASB-A-303835719 · Vendor Advisory
• https://media.defense.gov/2024/Oct/09/2003562611/-1/-1/0/CSA-UPDATE-ON-SVR-CYBER-OPS.PDF · Note
• https://t.me/cvenotify/62976 · Telegram Post
• https://vuldb.com/?id.246892 · Note
• https://twitter.com/CVEnew/status/1731808762560737353 · Twitter Post
• https://t.me/true_secator/5162 · Telegram Post
• https://twitter.com/xvonfers/status/1731746111113527804 · Twitter Post