Lucene search
PRIOn knowledge basePRION:CVE-2023-42468HistorySep 13, 2023 - 8:15 p.m.
Design/Logic Flaw
2023-09-1320:15:00
PRIOn knowledge base
www.prio-n.com
4
design flaw
logic flaw
android app
remote attacker
phone call initiation
improper export
third-party application
intent crafting
user consent
component export
security vulnerability
The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application (without any permissions) can craft an intent targeting com.cutestudio.dialer.activities.DialerActivity via the android.intent.action.CALL action in conjunction with a tel: URI, thereby placing a phone call.
| CPE | Name | Operator | Version |
|---|---|---|---|
| color_phone | eq | <= 2.1.8-2 |
Related
cvelist
cvelist
CVE-2023-42468
2023-09-13 00:00:00
nvd
nvd
CVE-2023-42468
2023-09-13 20:15:08
cve
cve
CVE-2023-42468
2023-09-13 20:15:08