CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-44123 – Bluetooth - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking
https://notcve.org/view.php?id=CVE-2023-44123
The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Bluetooth ("com.lge.bluetoothsetting") app. The attacker's app, if it had access to app notifications, could intercept them and redirect them to its activity, before making it grant access permissions to content providers with the `android:grantUriPermissions="true"` flag. La vulnerabilidad es el uso de PendingIntents implícitos con el conjunto PendingIntent.FLAG_MUTABLE que conduce al robo y/o (sobre)escritura de archivos arbitrarios con privilegios del sistema en la aplicación Bluetooth ("com.lge.bluetoothsetting"). La aplicación del atacante, si tuviera acceso a las notificaciones de la aplicación, podría interceptarlas y redirigirlas a su actividad, antes de otorgar permisos de acceso a los proveedores de contenido con el indicador `android:grantUriPermissions="true"`. • https://lgsecurity.lge.com/bulletins/mobile#updateDetails • CWE-285: Improper Authorization •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-44122 – LockScreenSettings - Theft arbitrary files with system privilege
https://notcve.org/view.php?id=CVE-2023-44122
The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. They also can return arbitrary data that will be passed to the "onActivityResult()" method. The LockScreenSettings app copies the received file to the "/data/shared/dw/mycategory/wallpaper_01.png" path and then changes the file access mode to world-readable and world-writable. La vulnerabilidad es el robo de archivos arbitrarios con privilegios del sistema en la aplicación LockScreenSettings ("com.lge.lockscreensettings") en el archivo "com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java". • https://lgsecurity.lge.com/bulletins/mobile#updateDetails • CWE-668: Exposure of Resource to Wrong Sphere CWE-927: Use of Implicit Intent for Sensitive Communication •
CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-44121 – LG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhere
https://notcve.org/view.php?id=CVE-2023-44121
The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action "com.lge.lms.things.notification.ACTION". Additionally, this vulnerability is very dangerous because LG ThinQ Service is a system app (having android:sharedUserId="android.uid.system" setting). Intent redirection in this app leads to accessing arbitrary not exported activities of absolutely all apps. La vulnerabilidad es una redirección de intención en LG ThinQ Service ("com.lge.lms2") en el archivo "com/lge/lms/things/ui/notification/NotificationManager.java". • https://lgsecurity.lge.com/bulletins/mobile#updateDetails • CWE-926: Improper Export of Android Application Components •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4616 – thumbnail Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability
https://notcve.org/view.php?id=CVE-2023-4616
This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the current user. • https://lgsecurity.lge.com/bulletins/idproducts#updateDetails https://www.zerodayinitiative.com/advisories/ZDI-23-1223 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4615 – updateFile Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability
https://notcve.org/view.php?id=CVE-2023-4615
This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/download/updateFile endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the current user. • https://lgsecurity.lge.com/bulletins/idproducts#updateDetails https://www.zerodayinitiative.com/advisories/ZDI-23-1224 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •