PT-2021-16630 · Samsung+1 · Samsung Members+1

Antonio Arlia Ciombo · Published 2021-07-08 · Updated 2022-07-25 · CVE-2021-25439

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Samsung Members versions prior to 2.4.85.11 in Android O(8.1) and below Samsung Members versions prior to 3.9.10.11 in Android P(9.0) and above

Description: The issue is related to improper access control in Samsung Members, allowing untrusted applications to cause arbitrary webpage loading in webview. This can potentially lead to security risks.

Recommendations: For Samsung Members versions prior to 2.4.85.11 in Android O(8.1) and below, update to version 2.4.85.11 or later. For Samsung Members versions prior to 3.9.10.11 in Android P(9.0) and above, update to version 3.9.10.11 or later. As a temporary workaround, consider restricting access to the webview component in Samsung Members until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-25439

Affected Products

Android

Samsung Members

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-25439 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25439 · Vendor Advisory
• https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=7 · Vendor Advisory
• https://t.me/cvenotify/17442 · Telegram Post
• https://t.me/cibsecurity/26009 · Telegram Post
• https://t.me/cvenotify/17252 · Telegram Post