Lucene search

[email protected]CVE-2022-36864

HistorySep 09, 2022 - 3:15 p.m.

CVE-2022-36864

2022-09-0915:15:12

CWE-284

[email protected]

web.nvd.nist.gov

cve-2022-36864

improper access control

intent redirection

samsung email

vulnerability

privileged behavior

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Improper access control and intent redirection in Samsung Email prior to 6.1.70.20 allows attacker to access specific formatted file and execute privileged behavior.

Affected configurations

NVD

Node

samsungsamsung_emailRange<6.1.70.20

CPENameOperatorVersion
samsung:samsung_emailsamsung samsung emaillt6.1.70.20

CPE	Name	Operator	Version
samsung:samsung_email	samsung samsung email	lt	6.1.70.20

CNA Affected

[
  {
    "product": "Samsung Email",
    "vendor": "Samsung Mobile",
    "versions": [
      {
        "lessThan": "6.1.70.20",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09

Social References

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2022-36864

cvelist1 nvd1 prion1