CVE-2023-21394

Summary

CVE-2023-21394 is a vulnerability affecting the TelecomServiceImpl.java component. In the function "registerPhoneAccount," there is a missing permission check, allowing an attacker to potentially reveal images from another user's account. This issue does not require any additional execution privileges and user interaction is not necessary for exploitation, resulting in local information disclosure.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.