Motorola Phone Calls App prior 2023-12-01 Phone Number implicit intent

Summaryinfo

A vulnerability categorized as problematic has been discovered in Motorola Phone Calls App. This affects an unknown part of the component Phone Number Handler. Such manipulation leads to implicit intent. This vulnerability is uniquely identified as CVE-2023-41824. Local access is required to approach this attack. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Motorola Phone Calls App and classified as problematic. Affected by this issue is an unknown functionality of the component Phone Number Handler. The manipulation with an unknown input leads to a implicit intent vulnerability. Using CWE to declare the problem leads to CWE-927. The Android application uses an implicit intent for transmitting sensitive data to other applications. Impacted is confidentiality. CVE summarizes:

An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the calling phone number and calling data.

The weakness was disclosed by Sergey Toshin and Illia Khorolskyi. The advisory is shared for download at en-us.support.motorola.com. This vulnerability is handled as CVE-2023-41824 since 09/01/2023. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

Upgrading to version 2023-12-01 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Motorola

Name

• Phone Calls App

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion