CVE-2023-21237

Summary

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912

Severity
Medium
Severity Score

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-ID

NVD-CWE-noinfo

Vulnerability ID
CVE-2023-21237
Severity
Medium
Severity Score
5.5
Summary
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912
References
https://source.android.com/security/bulletin/pixel/2023-06-01
Mitigation and Patches
Exploits
Metasploit Payload
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE ID
NVD-CWE-noinfo

See SecOps Solution
in action

Schedule Demo