CVE-2023-41828
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-41828 is a medium-severity Use of Implicit Intent for Sensitive Communication (CWE-927) vulnerability in Motorola Phone (inferred from references). Its CVSS base score is 4.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-46320
Vulnerability Data
An implicit intent export vulnerability was reported in the Motorola Phone application, that could allow unauthorized access to a non-exported content provider.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces explicit authorization decisions on which apps may receive sensitive data, directly stopping implicit-intent broadcast.
Requires approved information-flow rules between components, which implicit intents for sensitive data violate.
Protects confidentiality of transmitted data even if an unintended receiver obtains the intent.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prohibit implicit intents for sensitive data while this single CWE addresses only one narrow coding rule.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
DLP policies and technical controls directly prevent sensitive data from leaving via insecure implicit intents.
Network security rules can restrict inter-app communication channels that implicit intents rely on.
A.8.26 only requires that security requirements (including resilience against injections or input controls) be identified and specified during development; it does not itself enforce, implement or configure any mechanism that stops an implicit Intent from being used or exploited for sensitive data.
A.8.27 mandates establishing and applying secure engineering principles (including least privilege, security by design, distrust external input, and hardening) during the SDLC; while these principles could guide developers away from implicit intents, the control itself does not stop the resulting weakness from remaining present and exploitable in an already-built Android app.
Secure coding standards explicitly forbid implicit intents when handling sensitive information.