Lucene search

LGECVE-2023-44121

HistorySep 27, 2023 - 3:19 p.m.

CVE-2023-44121

2023-09-2715:19:35

CWE-926

LGE

web.nvd.nist.gov

cve-2023-44121

vulnerability

lg thinq service

intent redirection

com.lge.lms2

nvd

security

android

system app

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

AI Score

6.3

Confidence

High

EPSS

Percentile

12.7%

JSON

The vulnerability is an intent redirection in LG ThinQ Service (“com.lge.lms2”) in the “com/lge/lms/things/ui/notification/NotificationManager.java” file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action “com.lge.lms.things.notification.ACTION”. Additionally, this vulnerability is very dangerous because LG ThinQ Service is a system app (having android:sharedUserId=“android.uid.system” setting). Intent redirection in this app leads to accessing arbitrary not exported activities of absolutely all apps.

Affected configurations

Nvd

Node

googleandroidRange9.0–13.0

AND

lgv60_thin_q_5gMatch-

VendorProductVersionCPE
googleandroid*cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
lgv60_thin_q_5g-cpe:2.3:h:lg:v60_thin_q_5g:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	android	*	cpe:2.3:o:google:android::::::::
lg	v60_thin_q_5g	-	cpe:2.3:h:lg:v60_thin_q_5g:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "LG V60 Thin Q 5G(LMV600VM)",
    "vendor": "LG Electronics",
    "versions": [
      {
        "lessThanOrEqual": "13",
        "status": "affected",
        "version": "Android 9",
        "versionType": "Android"
      }
    ]
  }
]

References

lgsecurity.lge.com/bulletins/mobile#updateDetails

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

AI Score

6.3

Confidence

High

EPSS

Percentile

12.7%

JSON

Related for CVE-2023-44121