Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2023-21239: Android framework may expose images to other users
CVE-2023-21239 · published 3 years ago
Summary
The core Android system code can unintentionally share picture data between separate user accounts on the same device. This means one user could view images that belong to another user without needing special permissions or any action from the victim. Updating the device to the latest security patch will stop this behavior.
What to do
- Update google platform/frameworks/base to version 13-next:2023-07-01.
- Update google platform/frameworks/base to version 12:2023-07-01.
- Update google platform/frameworks/base to version 12L:2023-07-01.
- Update google platform/frameworks/base to version 13:2023-07-01.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Android | platform/frameworks/base |
>= 13-next:0, < 13-next:2023-07-01 >= 12:0, < 12:2023-07-01 >= 12L:0, < 12L:2023-07-01 >= 13:0, < 13:2023-07-01 Fix: upgrade to 13-next:2023-07-01
|
|
| – | android |
12.0 12.1 13.0 cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* |
Original advisory text
In visitUris of Notification.java, there is a possible way to leak image data across user boundaries due to a confused deputy. This could lead to local information disclosure with no additional exe...
In visitUris of Notification.java, there is a possible way to leak image data across user boundaries due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.5
Medium
Type
CWE-384Session Fixation
Timeline
Published1 Jul 2023
Updated30 Sep 2026
First seen10 Sep 2026
Track software like this
Free during beta