긴급도 55/100 심각도 5.5 · 보통 악용확률 17.5% CISA KEV · 2024-03-05 CWE-200

CVE-2023-21237

CISA 기관 조치 기한: 2024-03-26

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912

KEV 필수 조치: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

타임라인

2023-06-28 NVD 공개
2024-03-05 CISA KEV 등재(실제 악용 확인) 공개 후 251일
2024-03-26 CISA 기관 조치 기한 경과

벡터: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD 상세 ↗ GitHub Advisory ↗ 벤더 권고문 ↗ 참고 링크 ↗