cve/CVE-2023-49002 at main · actuator/cve · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
> [Description]
> An issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5
> allows an attacker to bypass intended access restrictions via interaction with
> com.funprime.calldialer.ui.activities.OutgoingActivity.
>
> ------------------------------------------
>
> [Vulnerability Type]
> Incorrect Access Control
>
> ------------------------------------------
>
> [VulnerabilityType Other]
> CWE-926: Improper Export of Android Application Components
>
> ------------------------------------------
>
> [Vendor of Product]
> Xenom Technologies
>
> ------------------------------------------
>
> [Affected Product Code Base]
> Phone Dialer-voice Call Dialer Xenom Technologies (com.sinous.voice.dialer) - Version 1.2.5
>
> ------------------------------------------
>
> [Affected Component]
> Exported Activity: com.funprime.calldialer.ui.activities.OutgoingActivity
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Impact Escalation of Privileges]
> true
>
> ------------------------------------------
>
> [Impact Information Disclosure]
> true
>
> ------------------------------------------
>
> [Attack Vectors]
> Unauthorized Calls: Malicious entities can exploit this vulnerability remotely to make unauthorized calls, which could lead to financial losses or privacy breaches without user interaction (with no permissions)
>
> ------------------------------------------
>
> [Reference]
> https://github.com/actuator/com.sinous.voice.dialer/blob/main/CWE-928.md
>
> ------------------------------------------
>
> [Discoverer]
> Edward Warren