Lucene search

[email protected]CVE-2022-36876

HistorySep 09, 2022 - 3:15 p.m.

CVE-2022-36876

2022-09-0915:15:13

CWE-285

[email protected]

web.nvd.nist.gov

cve-2022-36876

upi payment

samsung pass

authentication

physical attack

2.4 Low

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

3.9 Low

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.1%

JSON

Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication.

Affected configurations

NVD

Node

samsungsamsung_passRange<4.0.04.10android

CPENameOperatorVersion
samsung:samsung_passsamsung samsung passlt4.0.04.10

CPE	Name	Operator	Version
samsung:samsung_pass	samsung samsung pass	lt	4.0.04.10

CNA Affected

[
  {
    "product": "Samsung Pass",
    "vendor": "Samsung Mobile",
    "versions": [
      {
        "lessThan": "4.0.04.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09

Social References

2.4 Low

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

3.9 Low

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.1%

JSON

Related for CVE-2022-36876

prion1 cvelist1 nvd1