CVE-2023-42468

2023-09-1300:00:00

mitre

www.cve.org

android

vulnerability

phone call

authorization

third-party application

intent

uri

security

5.5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.3%

JSON

The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application (without any permissions) can craft an intent targeting com.cutestudio.dialer.activities.DialerActivity via the android.intent.action.CALL action in conjunction with a tel: URI, thereby placing a phone call.