CVE-2023-21237

MediumCVSS 5.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Jun 28, 2023
Last modified
Jun 17, 2026
Added to CISA KEV
Mar 5, 2024
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-212385.5In visitUris of RemoteViews.java, there is a possible leak of images between users due to a confused deputy. This could lead to local informCVE-2023-212395.5In visitUris of Notification.java, there is a possible way to leak image data across user boundaries due to a confused deputy. This could leCVE-2023-21247.8An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with CVE-2023-212405.5In Policy of Policy.java, there is a possible boot loop due to resource exhaustion. This could lead to local denial of service with no additCVE-2023-212417.8In rw_i93_send_to_upper of rw_i93.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalatioCVE-2023-212429.8In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible way to trust an imposter server due to a logic error in theCVE-2023-212435.5In validateForCommonR1andR2 of PasspointConfiguration.java, there is a possible way to inflate the size of a config file with no limits due CVE-2023-212446.7In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission check. This could lead CVE-2023-212457.8In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lock screen during deviCVE-2023-212463.3In ShortcutInfo of ShortcutInfo.java, there is a possible way for an app to retain notification listening access due to an uncaught exceptioCVE-2023-212477.8In getAvailabilityStatus of BluetoothScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restrictCVE-2023-212487.8In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction d
CVE-2023-21237: Medium severity, CVSS 5.5 | Vulnix