[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIACMF8apRZ0Me1kSf9yd-Nx3_Bvo7uCwwBr7wY0jkOs":3,"g5a-risk:CVE-2023-44124":127},{"success":4,"data":5,"meta":124},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":38,"epssPercentile":26,"epssTimeSeries":39,"severity":40,"affectedProducts":41,"affectedProductsCount":55,"references":56,"referencesCount":62,"weaknesses":63,"weaknessesCount":79,"isActivelyExploited":80,"cisaInfo":26,"otxData":26,"relatedBlogPosts":81,"seoMetadata":82,"configurations":107,"relatedVendorCves":122,"notableEvents":123},"CVE-2023-44124","What is CVE-2023-44124?","The vulnerability is to theft of arbitrary files with system privilege in the Screen recording (\"com.lge.gametools.gamerecorder\") app in the \"com\u002Flge\u002Fgametools\u002Fgamerecorder\u002Fsettings\u002FProfilePreferenceFragment.java\" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. They also can return arbitrary data that will be passed to the \"onActivityResult()\" method. The Screen recording app saves contents of arbitrary URIs to SD card which is a world-readable storage.","The vulnerability is to theft of arbitrary files with system privilege in the Screen recording (\"com.lge.gametools.gamerecorder\") app in the \"com\u002Flge\u002Fgametoo...","2023-09-27T15:19:35.903","2023-10-02T18:22:25.643",3.3,"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":26,"CVSSMetricV40":26},[16,29],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":22,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":22,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":23,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","LOCAL","LOW","NONE","REQUIRED","UNCHANGED",null,1.8,1.4,{"Source":30,"Type":31,"CVSSData":32,"ExploitabilityScore":27,"ImpactScore":37},"product.security@lge.com","Secondary",{"Version":20,"VectorString":33,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":24,"Scope":34,"ConfidentialityImpact":22,"IntegrityImpact":22,"AvailabilityImpact":22,"BaseScore":35,"BaseSeverity":36,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":22,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:L","CHANGED",6.1,"MEDIUM",3.7,0.00098,[38,38,38,38,38,38,38],"Low",[42,47,50],{"vendor":43,"product":44,"version":45,"criteria":46,"vulnerable":4},"google","android","12.0","cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*",{"vendor":43,"product":44,"version":48,"criteria":49,"vulnerable":4},"13.0","cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*",{"vendor":51,"product":52,"version":53,"criteria":54,"vulnerable":4},"lg","v60_thin_q_5g","-","cpe:2.3:h:lg:v60_thin_q_5g:-:*:*:*:*:*:*:*",3,[57],{"url":58,"source":59,"tags":60},"https:\u002F\u002Flgsecurity.lge.com\u002Fbulletins\u002Fmobile#updateDetails","Lge",[61],"Vendor Advisory",1,[64,72],{"id":65,"name":66,"description":67,"extendedDescription":68,"status":69,"abstraction":70,"structure":71},"CWE-668","Exposure of Resource to Wrong Sphere","The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.","Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing these private files. If the file permissions are insecure, then parties other than the user will be able to access those files.\nA separate control sphere might effectively require that the user can only access the private files, but not any other files on the system. If the program does not ensure that the user is only requesting private files, then the user might be able to access other files on the system.\nIn either case, the end result is that a resource has been exposed to the wrong party.","Draft","Class","Simple",{"id":73,"name":74,"description":75,"extendedDescription":76,"status":77,"abstraction":78,"structure":71},"CWE-927","Use of Implicit Intent for Sensitive Communication","The Android application uses an implicit intent for transmitting sensitive data to other applications.","Since an implicit intent does not specify a particular application to receive the data, any application can process the intent by using an Intent Filter for that intent. This can allow untrusted applications to obtain sensitive data. There are two variations on the standard broadcast intent, ordered and sticky.\nOrdered broadcast intents are delivered to a series of registered receivers in order of priority as declared by the Receivers. A malicious receiver can give itself a high priority and cause a denial of service by stopping the broadcast from propagating further down the chain. There is also the possibility of malicious data modification, as a receiver may also alter the data within the Intent before passing it on to the next receiver. The downstream components have no way of asserting that the data has not been altered earlier in the chain.\nSticky broadcast intents remain accessible after the initial broadcast. An old sticky intent will be broadcast again to any new receivers that register for it in the future, greatly increasing the chances of information exposure over time. Also, sticky broadcasts cannot be protected by permissions that may apply to other kinds of intents.\nIn addition, any broadcast intent may include a URI that references data that the receiving component does not normally have the privileges to access. The sender of the intent can include special privileges that grant the receiver read or write access to the specific URI included in the intent. A malicious receiver that intercepts this intent will also gain those privileges and be able to read or write the resource at the specified URI.","Incomplete","Variant",2,false,[],{"title":83,"metaDescription":84,"keywords":85,"canonicalUrl":86,"structuredData":87},"What is CVE-2023-44124? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2023-44124, a low severity cyber security vulnerability from 2023. The vulnerability is to theft of arbitrary files with system...","CVE-2023-44124, CVE-2023-44124 vulnerability, CVE-2023-44124 security, low severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2023, CVSS score, exploit, patch, remediation, google security, lg security, android vulnerability, v60_thin_q_5g vulnerability","\u002Fwhat-is\u002Fcve-2023-44124",{"@context":88,"@type":89,"headline":83,"description":84,"datePublished":10,"dateModified":11,"author":90,"publisher":94,"about":98,"mainEntityOfPage":102,"articleSection":105,"keywords":106},"https:\u002F\u002Fschema.org","TechArticle",{"@type":91,"name":92,"url":93},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":91,"name":92,"url":93,"logo":95},{"@type":96,"url":97},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":99,"name":6,"description":100,"additionalType":101},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":103,"@id":104},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2023-44124","Cybersecurity","CVE-2023-44124, CVE-2023-44124 vulnerability, CVE-2023-44124 security, low severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[108],{"Operator":109,"Negate":26,"Nodes":110},"AND",[111,118],{"Operator":112,"Negate":26,"CPEMatch":113},"OR",[114,116],{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":115,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"F8FB8EE9-FC56-4D5E-AE55-A5967634740C",{"Vulnerable":4,"Criteria":49,"MatchCriteriaID":117,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"879FFD0C-9B38-4CAA-B057-1086D794D469",{"Operator":112,"Negate":26,"CPEMatch":119},[120],{"Vulnerable":26,"Criteria":54,"MatchCriteriaID":121,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"85B3B7D2-762E-4DD5-90F9-5246907748C4",[],[],{"lastModified":11,"cacheTime":125,"version":126},1792371363950,"2.0",{"score":128,"band":40,"action":129,"scoredAt":130},21,"Monitor","2026-10-16T06:59:15.389328+00:00"]