CVE-2023-21294

In Slice, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

• CWE-862

• https://source.android.com/docs/security/bulletin/android-14Release Notes, Vendor Advisory
• https://source.android.com/docs/security/bulletin/android-14Release Notes, Vendor Advisory

Published

Oct 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-21288In visitUris of Notification.java, there is a possible way t…5.5
• CVE-2023-21289In multiple locations, there is a possible bypass of a multi…5.5
• CVE-2023-21290In update of MmsProvider.java, there is a possible way to by…5.5
• CVE-2023-21291In visitUris of Notification.java, there is a possible way t…5.5
• CVE-2023-21292In openContentUri of ActivityManagerService.java, there is a…5.5
• CVE-2023-21293In PackageManagerNative, there is a possible way to determin…5.5
• CVE-2023-21295In SliceManagerService, there is a possible way to check if …5.5
• CVE-2023-21296In Permission, there is a possible way to determine whether …5.5
• CVE-2023-21297In SEPolicy, there is a possible way to access the factory M…4.4
• CVE-2023-21298In Slice, there is a possible disclosure of installed applic…7.8
• CVE-2023-21299In Package Manager, there is a possible way to determine whe…5.5
• CVE-2023-2130A vulnerability classified as critical has been found in Sou…9.8