Lucene search

[email protected]CVE-2022-36859

HistorySep 09, 2022 - 3:15 p.m.

CVE-2022-36859

2022-09-0915:15:12

CWE-20

CWE-79

[email protected]

web.nvd.nist.gov

cve-2022-36859

smarttagplugin

input validation

privilege escalation

xss

5.7 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victim's devices.

Affected configurations

NVD

Node

samsungsmarttagpluginRange<1.2.21-6

CPENameOperatorVersion
samsung:smarttagpluginsamsung smarttagpluginlt1.2.21-6

CPE	Name	Operator	Version
samsung:smarttagplugin	samsung smarttagplugin	lt	1.2.21-6

CNA Affected

[
  {
    "product": "SmartTagPlugin",
    "vendor": "Samsung Mobile",
    "versions": [
      {
        "lessThan": "1.2.21-6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09

Social References

5.7 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2022-36859

prion1 cvelist1 nvd1