PT-2023-28451 · Samsung · Galaxy Store

CVE-2023-42581 · Publicado 2023-12-04 · Atualizado 2024-08-29

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Galaxy Store versions prior to 4.5.64.4

Description The issue is related to improper URL validation from InstantPlay deeplink in Galaxy Store, allowing attackers to execute JavaScript API and access data. This can lead to remote code execution.

Recommendations For Galaxy Store versions prior to 4.5.64.4, update to version 4.5.64.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the InstantPlay deeplink feature until a patch is applied. Avoid using the InstantPlay deeplink in the affected Galaxy Store versions until the issue is resolved.

Correção

Identificadores relacionados

CVE-2023-42581

ZDI-24-830

Produtos afetados

Galaxy Store

Referências · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-42581 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1731927574324916352 · Publicação no Twitter
• https://t.me/cvenotify/63236 · Publicação no Telegram
• https://t.me/cvenotify/92742 · Publicação no Telegram
• https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12 · Aviso do Fabricante
• https://t.me/cvenotify/92540 · Publicação no Telegram
• https://t.me/cvenotify/92561 · Publicação no Telegram
• https://zerodayinitiative.com/advisories/ZDI-24-830 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-42581 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1731869102350770539 · Publicação no Twitter