CVE-2023-44124CWE-927

Screen recording - Theft of arbitrary files with system privilege

Medium · published September 27, 2023

CVSS v3.1
6.1
EPSS
0%
Percentile
0.7
In the wild
Unconfirmed
What it is

The vulnerability is to theft of arbitrary files with system privilege in the Screen recording ("com.lge.gametools.gamerecorder") app in the "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. They also can return arbitrary data that will be passed to the "onActivityResult()" method. The Screen recording app saves contents of arbitrary URIs to SD card which is a world-readable storage.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00098 · 0.7th percentile
Weakness
CWE-927 · Use of Implicit Intent for Sensitive Communication
Published
2023-09-27T13:55Z
EPSS history
Timeline
  • 27 SEP 13:55Z
    Screen recording - Theft of arbitrary files with system privilege
    cvelistv5