PT-2023-17898 · Google · Android

CVE-2023-21104

·

Publicado

2023-05-01

·

Atualizado

2025-01-24

CVSS v3.1

5.5

Média

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Android versions Android-12L through Android-13
Description A missing permission check in the applySyncTransaction function of WindowOrganizer.java could lead to local information disclosure without requiring additional execution privileges. User interaction is not necessary for exploitation.
Recommendations For Android versions Android-12L through Android-13, consider restricting access to the applySyncTransaction function in WindowOrganizer.java until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

ASB-A-259938771
CVE-2023-21104

Produtos afetados

Android