PT-2021-16541 · Samsung · Samsung Internet

Published 2021-03-04 · Updated 2021-03-05 · CVE-2021-25348

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Samsung Internet versions prior to 13.0.1.60

Description: The issue is related to an improper permission grant check, allowing access to files in internal storage without the authorized STORAGE permission. This affects Samsung Internet, enabling unauthorized access to internal storage files.

Recommendations: For versions prior to 13.0.1.60, update to version 13.0.1.60 or later to resolve the issue. As a temporary workaround, consider restricting access to internal storage files until the update is applied.

Fix

Weakness Enumeration

CWE-703

Related Identifiers

CVE-2021-25348

Affected Products

Samsung Internet

References · 5

• https://osv.dev/vulnerability/CVE-2021-25348 · Vendor Advisory
• https://security.samsungmobile.com · Vendor Advisory
• https://security.samsungmobile.com/serviceWeb.smsb · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25348 · Security Note
• https://t.me/cibsecurity/24473 · Telegram Post