Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-21300
CVE-2023-21300:
NixOS vulnerability analysis and mitigation
Overview
In PackageManager, there is a possible way to determine whether an app is installed without query permissions due to side channel information disclosure. This vulnerability, identified as CVE-2023-21300, affects Android versions prior to Android 14.0. The vulnerability was disclosed and documented in the Android 14 Security Bulletin (Android Bulletin).
Technical details
The vulnerability is classified with a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability stems from a side channel information disclosure in the PackageManager component, which could allow an attacker to determine the installation status of applications without having the necessary query permissions (NVD).
Impact
The vulnerability allows local information disclosure without requiring additional execution privileges. An attacker could potentially determine which applications are installed on a device without having the proper permissions to query this information (NVD).
Mitigation and workarounds
The vulnerability has been patched in Android 14.0. Users and organizations should upgrade their Android devices to version 14.0 or later to mitigate this vulnerability (Android Bulletin).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management