Lucene search

Samsung MobileCVELIST:CVE-2022-28791

HistoryMay 03, 2022 - 7:43 p.m.

CVE-2022-28791

2022-05-0319:43:31

CWE-20

Samsung Mobile

www.cve.org

installagent

galaxy store

input validation

vulnerability

file overwrite

patch

protection

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

Percentile

5.1%

JSON

Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4.5.41.8 allows attacker to overwrite files stored in a specific path. The patch adds proper protection to prevent overwrite to existing files.

CNA Affected

[
  {
    "product": "Galaxy Store",
    "vendor": "Samsung Mobile",
    "versions": [
      {
        "lessThan": "4.5.41.3",
        "status": "affected",
        "version": "-",
        "versionType": "custom"
      }
    ]
  }
]

References

security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

Percentile

5.1%

JSON

Related for CVELIST:CVE-2022-28791