CVE-2023-44123: Bluetooth - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking
First published: Wed Sep 27 2023(Updated: )
The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Bluetooth ("com.lge.bluetoothsetting") app. The attacker's app, if it had access to app notifications, could intercept them and redirect them to its activity, before making it grant access permissions to content providers with the `android:grantUriPermissions="true"` flag.
Credit: product.security@lge.com product.security@lge.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Android | =12.0 | |
| Google Android | =13.0 | |
| Lg V60 Thin Q 5g |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-44123?
CVE-2023-44123 is a vulnerability in the Bluetooth app on Google Android and LG V60 Thin Q 5g devices that allows an attacker's app to steal or overwrite arbitrary files with system privileges.
How does CVE-2023-44123 affect Google Android and LG V60 Thin Q 5g devices?
CVE-2023-44123 affects Google Android versions 12.0 and 13.0, allowing an attacker's app to intercept app notifications and potentially steal or overwrite files with system privileges. LG V60 Thin Q 5g is not vulnerable to this specific issue.
What is the severity of CVE-2023-44123?
CVE-2023-44123 has a severity rating of 7.8, which is considered high.
How can CVE-2023-44123 be mitigated?
To mitigate CVE-2023-44123, users should update their Google Android devices to the latest available version and apply any patches or security updates provided by their device manufacturer.
Where can I find more information about CVE-2023-44123?
More information about CVE-2023-44123 can be found in the LG Security Bulletins on the LG website.
- agent/type
- agent/author
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/event
- agent/tags
- agent/description
- agent/first-publish-date
- vendor/google
- canonical/google android
- version/google android/12.0
- version/google android/13.0
- vendor/lg
- canonical/lg v60 thin q 5g