CVE-2023-21244

In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://android.googlesource.com/platform/frameworks/base/+/20aedba4998373addc2befcc455a118585559fef	Mailing List Patch
https://android.googlesource.com/platform/frameworks/base/+/3a448067ac9ebdf669951e90678c2daa592a81d3	Mailing List Patch
https://android.googlesource.com/platform/frameworks/base/+/5a3d0c131175d923cf35c7beb3ee77a9e6485dad	Mailing List Patch
https://source.android.com/security/bulletin/2023-10-01	Patch Vendor Advisory
https://android.googlesource.com/platform/frameworks/base/+/20aedba4998373addc2befcc455a118585559fef	Mailing List Patch
https://android.googlesource.com/platform/frameworks/base/+/3a448067ac9ebdf669951e90678c2daa592a81d3	Mailing List Patch
https://android.googlesource.com/platform/frameworks/base/+/5a3d0c131175d923cf35c7beb3ee77a9e6485dad	Mailing List Patch
https://source.android.com/security/bulletin/2023-10-01	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:google:android:11.0:::::::*
	cpe:2.3:o:google:android:12.0:::::::*
	cpe:2.3:o:google:android:12.1:::::::*
	cpe:2.3:o:google:android:13.0:::::::*

History

21 Nov 2024, 07:42

Type	Values Removed	Values Added
References	~~() https://android.googlesource.com/platform/frameworks/base/+/20aedba4998373addc2befcc455a118585559fef - Mailing List, Patch~~	() https://android.googlesource.com/platform/frameworks/base/+/20aedba4998373addc2befcc455a118585559fef - Mailing List, Patch
References	~~() https://android.googlesource.com/platform/frameworks/base/+/3a448067ac9ebdf669951e90678c2daa592a81d3 - Mailing List, Patch~~	() https://android.googlesource.com/platform/frameworks/base/+/3a448067ac9ebdf669951e90678c2daa592a81d3 - Mailing List, Patch
References	~~() https://android.googlesource.com/platform/frameworks/base/+/5a3d0c131175d923cf35c7beb3ee77a9e6485dad - Mailing List, Patch~~	() https://android.googlesource.com/platform/frameworks/base/+/5a3d0c131175d923cf35c7beb3ee77a9e6485dad - Mailing List, Patch
References	~~() https://source.android.com/security/bulletin/2023-10-01 - Patch, Vendor Advisory~~	() https://source.android.com/security/bulletin/2023-10-01 - Patch, Vendor Advisory

12 Oct 2023, 16:46

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.7
First Time		Google android Google
CWE		CWE-862
References	~~(MISC) https://android.googlesource.com/platform/frameworks/base/+/3a448067ac9ebdf669951e90678c2daa592a81d3 -~~	(MISC) https://android.googlesource.com/platform/frameworks/base/+/3a448067ac9ebdf669951e90678c2daa592a81d3 - Mailing List, Patch
References	~~(MISC) https://android.googlesource.com/platform/frameworks/base/+/5a3d0c131175d923cf35c7beb3ee77a9e6485dad -~~	(MISC) https://android.googlesource.com/platform/frameworks/base/+/5a3d0c131175d923cf35c7beb3ee77a9e6485dad - Mailing List, Patch
References	~~(MISC) https://android.googlesource.com/platform/frameworks/base/+/20aedba4998373addc2befcc455a118585559fef -~~	(MISC) https://android.googlesource.com/platform/frameworks/base/+/20aedba4998373addc2befcc455a118585559fef - Mailing List, Patch
References	~~(MISC) https://source.android.com/security/bulletin/2023-10-01 -~~	(MISC) https://source.android.com/security/bulletin/2023-10-01 - Patch, Vendor Advisory
CPE		cpe:2.3:o:google:android:12.0:::::::* cpe:2.3:o:google:android:11.0:::::::* cpe:2.3:o:google:android:12.1:::::::* cpe:2.3:o:google:android:13.0:::::::*

06 Oct 2023, 19:41

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-06 19:15

Updated : 2024-11-21 07:42

NVD link : CVE-2023-21244

Mitre link : CVE-2023-21244

CVE.ORG link : CVE-2023-21244

JSON object : View

Products Affected

google

android

CWE

CWE-862

Missing Authorization

6.7 /10