Rule Definition
The attacks and consequences of improperly exporting a component may depend on the exported component: If access to a Content Provider is not restricted to only the expected applications, then malicious applications might be able to access the sensitive data. Note that in Android before 4.2, the Content Provider is automatically exported unless it has been explicitly declared as NOT exported.

Remediation
If this is a private content provider, you should set exported = "False" definitely. If this is a shared content provider, the exported = "True" and you should set the permission for client apps to protect your data.

Violation Code Sample

Ambiguous content provider:
<provider android:name=".content.AccountProvider" 
          android:authorities="jp.co.vulnerable.accountprovider" />

Public content provider, all apps can access:
<provider android:name=".content.AccountProvider" 
          android:authorities="jp.co.vulnerable.accountprovider" 
          android:exported="true" 
          />

Fixed Code Sample

Define a private content provider:
  <provider android:name=".content.AccountProvider" 
          android:authorities="jp.co.vulnerable.accountprovider" 
          android:exported="false"/>

Restrict access to content provider:

  define the permission in AndroidManifest.xml:
  <permission android:name="com.myapp.WRITE.PERMISSION"
          android:protectionLevel="signature">
  </permission>

  <permission android:name="com.myapp.READ.PERMISSION"
          android:protectionLevel="signature">
  </permission>

  <provider android:name=".content.AccountProvider" 
          android:authorities="jp.co.vulnerable.accountprovider" 
          android:exported="true"
          android:readpermission = "com.myapp.READ.PERMISSION"
          android:writepermission = "com.myapp.WRITE.PERMISSION">

  Give the access permission for the client apps (in AndroidManifest.xml of client apps):

  <uses-permission android:name="com.myapp.READ_PERMISSION"/>
  <uses-permission android:name="com.myapp.WRITE_PERMISSION"/>

https://cwe.mitre.org/data/definitions/926.html https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure https://developer.android.com/topic/security/best-practices https://www.oreilly.com/library/view/application-security-for/9781449322250/ch04.html