PT-2018-9918 · Samsung · Samsung Email

Published 2018-06-07 · Updated 2019-10-09 · CVE-2018-10497

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Samsung Email versions prior to 5.0.02.16

Description: This issue allows local attackers to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the handling of EML files, resulting from the lack of proper validation of user-supplied data, which can allow arbitrary JavaScript to execute. This can allow an attacker to escalate privileges to resources normally protected from the application.

Recommendations: For versions prior to 5.0.02.16, update to version 5.0.02.16 to resolve the issue. As a temporary workaround, consider restricting the handling of EML files until the update is applied. Avoid using the vulnerable EML file parsing functionality in Samsung Email until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-10497

ZDI-18-556

Affected Products

Samsung Email

References · 3

• https://zerodayinitiative.com/advisories/ZDI-18-556 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10497 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10497 · Security Note