CVE-2023-21388

In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

• CWE-862

• https://source.android.com/docs/security/bulletin/android-14Release Notes, Vendor Advisory
• https://source.android.com/docs/security/bulletin/android-14Release Notes, Vendor Advisory

Published

Oct 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-21381In Media Resource Manager, there is a possible local arbitra…7.8
• CVE-2023-21382In Content Resolver, there is a possible method to access me…5.5
• CVE-2023-21383In Settings, there is a possible way for the user to uninten…5.5
• CVE-2023-21384In Package Manager, there is a possible possible permissions…5.5
• CVE-2023-21385In Whitechapel, there is a possible out of bounds read due t…5.5
• CVE-2023-21387In User Backup Manager, there is a possible way to leak a to…4.4
• CVE-2023-21389In Settings, there is a possible bypass of profile owner res…7.8
• CVE-2023-2139 A reflected Cross-site Scripting (XSS) Vulnerability in DEL…6.1
• CVE-2023-21390In Sim, there is a possible way to evade mobile preference r…7.8
• CVE-2023-21391In Messaging, there is a possible way to disable the messagi…7.5
• CVE-2023-21392In Bluetooth, there is a possible way to corrupt memory due …8.8
• CVE-2023-21393In Settings, there is a possible way for the user to change …7.8