Lucene search

Samsung MobileCVE-2023-42551

HistoryNov 07, 2023 - 8:15 a.m.

CVE-2023-42551

2023-11-0708:15:22

CWE-668

Samsung Mobile

web.nvd.nist.gov

cve-2023-42551

implicit intent

sensitive communication

vulnerability

starttncactivity

samsung account

arbitrary file access

security

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

18.1%

JSON

Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.

Affected configurations

Nvd

Node

samsungaccountRange<14.5.00.7

VendorProductVersionCPE
samsungaccount*cpe:2.3:a:samsung:account:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
samsung	account	*	cpe:2.3:a:samsung:account::::::::

CNA Affected

[
  {
    "vendor": "Samsung Mobile",
    "product": "Samsung Account",
    "versions": [
      {
        "status": "unaffected",
        "version": "14.5.00.7"
      }
    ],
    "defaultStatus": "affected"
  }
]

References

security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

18.1%

JSON

Related for CVE-2023-42551