The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action "com.lge.lms.things.notification.ACTION". Additionally, this vulnerability is very dangerous because LG ThinQ Service is a system app (having android:sharedUserId="android.uid.system" setting). Intent redirection in this app leads to accessing arbitrary not exported activities of absolutely all apps.
History

Mon, 23 Sep 2024 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: LGE

Published: 2023-09-27T08:36:44.574Z

Updated: 2024-09-23T18:16:52.161Z

Reserved: 2023-09-26T05:57:13.268Z

Link: CVE-2023-44121

cve-icon Vulnrichment

Updated: 2024-08-02T19:59:51.069Z

cve-icon NVD

Status : Modified

Published: 2023-09-27T15:19:35.680

Modified: 2024-11-21T08:25:17.283

Link: CVE-2023-44121

cve-icon Redhat

No data.