CVE-2023-40127

2023-10-2721:15:08

[email protected]

web.nvd.nist.gov

screenshot access

confused deputy

local information disclosure

user interaction} .

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

3.5

Confidence

High

EPSS

Percentile

5.1%

JSON

In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected configurations

Nvd

Node

googleandroidMatch11.0

googleandroidMatch12.0

googleandroidMatch12.1

googleandroidMatch13.0

VendorProductVersionCPE
googleandroid11.0cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*
googleandroid12.0cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
googleandroid12.1cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*
googleandroid13.0cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	android	11.0	cpe:2.3:o:google:android:11.0:::::::*
google	android	12.0	cpe:2.3:o:google:android:12.0:::::::*
google	android	12.1	cpe:2.3:o:google:android:12.1:::::::*
google	android	13.0	cpe:2.3:o:google:android:13.0:::::::*