CVE-2023-44129
CVSS 3.1 Score 3.3 of 10 (low)
Details
Summary
CVE-2023-44129 is a vulnerability affecting the Messaging app patched by LG. The issue lies in the "com.android.mms.ui.QClipIntentReceiverActivity" activity, which forwards attacker-controlled intents back to the attacker. An attacker can exploit this vulnerability by launching this activity and broadcasting an intent with the "com.lge.message.action.QCLIP" action. By setting Intent.FLAG_GRANT_* flags and sending their own data/clipdata, the attacker can gain access to arbitrary content providers on the affected device that have the `android:grantUriPermissions="true"` flag set.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Android
Affected Vendors
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions