PT-2018-9918 · Samsung · Samsung Email

Publicado 2018-06-07 · Atualizado 2019-10-09 · CVE-2018-10497

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Samsung Email versions prior to 5.0.02.16

Description: This issue allows local attackers to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the handling of EML files, resulting from the lack of proper validation of user-supplied data, which can allow arbitrary JavaScript to execute. This can allow an attacker to escalate privileges to resources normally protected from the application.

Recommendations: For versions prior to 5.0.02.16, update to version 5.0.02.16 to resolve the issue. As a temporary workaround, consider restricting the handling of EML files until the update is applied. Avoid using the vulnerable EML file parsing functionality in Samsung Email until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-10497

ZDI-18-556

Produtos afetados

Samsung Email

Referências · 3

• https://zerodayinitiative.com/advisories/ZDI-18-556 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-10497 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-10497 · Nota de Segurança