Security Resilience

CVE-2023-44127

Google Android 8.0 – 13.0

Published
27 September 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 3.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
EPSS Score 0.0013 2th percentile
Risk Priority 29 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-44127 is a low-severity Use of Implicit Intent for Sensitive Communication (CWE-927) vulnerability in Google Android. Its CVSS base score is 3.6 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers.

CWE(s)
CWE-927NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-44126Same product: Google Android
CVE-2023-44121Same product: Google Android
CVE-2023-44125Same product: Google Android
CVE-2023-44123Same product: Google Android
CVE-2023-31014Same product: Google Android
CVE-2023-41820Shared CWE-927
CVE-2023-41826Shared CWE-927
CVE-2024-3480Shared CWE-927
CVE-2023-41824Shared CWE-927
CVE-2023-41828Shared CWE-927

Affected Assets

google
android
8.0 — 13.0

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices directly prohibit implicit intents for sensitive data while this single CWE addresses only one narrow coding rule.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.26 Response to information security incidents partial match
removes
A.8.12 Data leakage prevention partial match
degrades

DLP policies and technical controls directly prevent sensitive data from leaving via insecure implicit intents.

A.8.20 Networks security partial match
degrades

Network security rules can restrict inter-app communication channels that implicit intents rely on.

A.8.26 Application security requirements partial match
blocks

A.8.26 only requires that security requirements (including resilience against injections or input controls) be identified and specified during development; it does not itself enforce, implement or configure any mechanism that stops an implicit Intent from being used or exploited for sensitive data.

A.8.27 Secure system architecture and engineering principles partial match
blocks

A.8.27 mandates establishing and applying secure engineering principles (including least privilege, security by design, distrust external input, and hardening) during the SDLC; while these principles could guide developers away from implicit intents, the control itself does not stop the resulting weakness from remaining present and exploitable in an already-built Android app.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly forbid implicit intents when handling sensitive information.

References