Vulnerability Details : CVE-2023-40120
In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Published
2023-10-27 21:15:09
Updated
2023-10-30 17:13:14
Products affected by CVE-2023-40120
- cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-40120
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-40120
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
References for CVE-2023-40120
-
https://source.android.com/security/bulletin/2023-10-01
Android Security Bulletin—October 2023 | Android Open Source ProjectPatch;Vendor Advisory
-
https://android.googlesource.com/platform/frameworks/base/+/d26544e5a4fd554b790b4d0c5964d9e95d9e626b
d26544e5a4fd554b790b4d0c5964d9e95d9e626b - platform/frameworks/base - Git at GooglePatch
Jump to