Skip to main content

Improper Verification of Intent by Broadcast Receiver

CVE-2023-44126

Low
3.6/10

Summary

The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers, contacts info, etc.

  • LOW
  • LOCAL
  • NONE
  • CHANGED
  • REQUIRED
  • NONE
  • LOW
  • NONE

CWE-925 - Improper Verification of Intent by Broadcast Receiver

The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.

References

Advisory Timeline

  • Published