Cyber Resilience

CVE-2023-44127

Google Android 8.0 – 13.0

Published
27 September 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 3.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
EPSS Score 0.0012 2th percentile
Risk Priority 28 floored blend · peak EPSS

Summary

CVE-2023-44127 is a low-severity Use of Implicit Intent for Sensitive Communication (CWE-927) vulnerability in Google Android. Its CVSS base score is 3.6 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers.

CWE(s)
CWE-927NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-44123Same product: Google Android
CVE-2023-44125Same product: Google Android
CVE-2023-44126Same product: Google Android
CVE-2023-44121Same product: Google Android
CVE-2023-21109Same product: Google Android
CVE-2023-21115Same product: Google Android
CVE-2026-28577Same product: Google Android
CVE-2026-0007Same product: Google Android
CVE-2024-31324Same product: Google Android
CVE-2023-20913Same product: Google Android

Affected Assets

google
android
8.0 — 13.0

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prohibit implicit intents for sensitive data while this single CWE addresses only one narrow coding rule.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect the weakness but does not itself prevent it at runtime.

A.8.12 Data leakage prevention partial match
mitigates

DLP policies and technical controls directly prevent sensitive data from leaving via insecure implicit intents.

A.8.20 Networks security partial match
degrades

Network security rules can restrict inter-app communication channels that implicit intents rely on.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate explicit intents or secure IPC for sensitive data.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles discourage implicit intents for sensitive payloads.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly forbid implicit intents when handling sensitive information.

References