PT-2022-19231 · Samsung · Galaxy Themes

Published 2022-05-03 · Updated 2022-05-11 · CVE-2022-28783

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Galaxy Themes versions prior to SMR May-2022 Release 1

Description The issue is related to improper validation of removing package names, allowing attackers to uninstall arbitrary packages without permission. This affects devices prior to the SMR May-2022 Release 1. The patch for this issue adds proper validation logic for removing package names.

Recommendations For Galaxy Themes versions prior to SMR May-2022 Release 1, update to the SMR May-2022 Release 1 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-28783

Affected Products

Galaxy Themes

References · 4

• https://osv.dev/vulnerability/CVE-2022-28783 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28783 · Security Note
• https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5 · Vendor Advisory
• https://t.me/cibsecurity/41881 · Telegram Post