CVE-2023-40124

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In multiple locations, there is a possible cross-user read due to a confused deputy. This could lead to local information disclosure of photos or other images with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Feb 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-401257.8In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. This could lead to loc CVE-2023-401273.3In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local information disclosu CVE-2023-401287.8In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalat CVE-2023-401298.8In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (pro CVE-2023-40136.5The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 does not have proper CSRF checks when managing its l CVE-2023-401307.8In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. This could lead to loc CVE-2023-401317.0In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privileg CVE-2023-401327.8In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permissions due to a missin CVE-2023-401335.5In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead CVE-2023-401343.3In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local inf CVE-2023-401353.3In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to CVE-2023-401363.3In setHeader of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local