Call management - Implicit activity intents disclose contact details and phone numbers
CVE-2023-44127

3.6LOW

Key Information:

Vendor

Lg Electronics

Status
Lg V60 Thin Q 5g(lmv600vm)
Vendor
CVE Published:
27 September 2023

What is CVE-2023-44127?

he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers.

Affected Version(s)

LG V60 Thin Q 5G(LMV600VM) Android 8 <= 13

References

https://lgsecurity.lge.com/bulletins/mobile#updateDetails
vendor-advisory

CVSS V3.1

Score:
3.6
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.