ASB-A-257030107

vendorUSosv

view advisory published 2023-04-01Licence: per source

In getNumberFromCallIntent of NewOutgoingCallIntentBroadcaster.java, there is a possible way to enumerate other user's contact phone number due to a confused deputy. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-21082US	medium5.5	0.08% (0th)	—	2023-04-19
In getNumberFromCallIntent of NewOutgoingCallIntentBroadcaster.java, there is a possible way to enumerate other user's contact phone number due to a confused deputy. This could lea…

references

External citations — patches, advisories, analysis.

https://android.googlesource.com/platform/packages/services/Telecomm/+/e96d20e5244346179f49a88fea8ab5e0929444e5FIX
https://source.android.com/security/bulletin/2023-04-01ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan