CVE-2023-44122
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Summary
CVE-2023-44122 is a vulnerability that affects the LockScreenSettings app ("com.lge.lockscreensettings") on devices running certain products. The vulnerability allows for theft of arbitrary files with system privileges. The issue arises from the app launching implicit intents that can be intercepted by third-party apps, which can return arbitrary data to the app's "onActivityResult()" method. The LockScreenSettings app then copies the received file to a specific path and changes the file access mode to world-readable and world-writable. To remediate this vulnerability, users should update their affected products to the latest version provided by the vendor. This vulnerability poses a medium risk to organizations as it could potentially lead to unauthorized access and theft of sensitive files on affected devices.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions