PT-2021-16594 · Samsung · Samsung Account

Hard · Published 2021-06-11 · Updated 2022-07-30 · CVE-2021-25403

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Samsung Account versions prior to 10.8.0.4 Samsung Account versions prior to 12.2.0.9 in Android Q(10.0) and above

Description: The issue allows an attacker to access contacts and file provider using the SettingWebView component.

Recommendations: For versions prior to 10.8.0.4, update to version 10.8.0.4 or later. For versions prior to 12.2.0.9 in Android Q(10.0) and above, update to version 12.2.0.9 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-25403

Affected Products

Samsung Account

References · 4

• https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25403 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25403 · Security Note
• https://t.me/cvenotify/16203 · Telegram Post