CVE-2023-21260: Medium severity android vulnerability
Published Jul 13, 2023
·Updated
In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user prompt and possibly contains mis-leading information to be appeared as a system message for user confirmation.
Affected Software
4 affected components
Google Android=10.0
Google Android=11.0
Google Android=12.1
Google Android=13.0
Event History
Jul 13, 2023
CVE Published
via MITRE·12:01 AM
Data Sourced
via MITRE·12:01 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-21260?
CVE-2023-21260 has been rated as a medium severity vulnerability.
2
How do I fix CVE-2023-21260?
To fix CVE-2023-21260, users should update their Android devices to the latest security patches provided by Google.
3
Which versions of Android are affected by CVE-2023-21260?
CVE-2023-21260 affects Android versions 10.0, 11.0, 12.1, and 13.0.
4
What type of attack does CVE-2023-21260 facilitate?
CVE-2023-21260 facilitates misleading user prompts via a long service label in the notification access permission dialog.
5
Can CVE-2023-21260 be exploited by any application?
Yes, CVE-2023-21260 can be exploited by malicious applications that gain notification access permission.