← Back

CVE-2023-44121

nvd nist
Published: Sep 27, 2023Modified: Jun 17, 2026

JSON object

Loading...
6.3
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
Exploitability: 1.8 / Impact: 4.0
Source: NVD

Description

The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action "com.lge.lms.things.notification.ACTION". Additionally, this vulnerability is very dangerous because LG ThinQ Service is a system app (having android:sharedUserId="android.uid.system" setting). Intent redirection in this app leads to accessing arbitrary not exported activities of absolutely all apps.

Affected (1)

Products: Google: Android
Google
1 product
Android
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Android
From 9.0 to 13.0
Running on/withPlatform Versions
Lg
V60 Thin Q 5g
All versions

Related CWEs

CWE-926
Improper Export of Android Application Components
The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

References (2)

Source: product.security@lge.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.