Lucene search

K
cve[email protected]CVE-2023-21515
HistoryMay 26, 2023 - 10:15 p.m.

CVE-2023-21515

2023-05-2622:15:14
CWE-20
web.nvd.nist.gov
17
cve-2023-21515
instantplay
script vulnerability
galaxy store
apk installation
nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.8%

InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.

Affected configurations

NVD
Node
samsunggalaxy_storeRange<4.5.49.8

CNA Affected

[
  {
    "vendor": "Samsung Mobile",
    "product": "Galaxy Store",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "4.5.49.8",
        "versionType": "custom"
      }
    ]
  }
]

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.8%

Related for CVE-2023-21515