PT-2022-23673 · Unknown · Contactsprovider

Sergey Toshin · Published 2022-09-09 · Updated 2022-10-01 · CVE-2022-36869

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Contacts Provider versions prior to 12.7.59

Description The issue is related to an improper access control vulnerability in the ContactsDumpActivity of the Contacts Provider. This vulnerability allows an attacker to access a file without the necessary permissions.

Recommendations For versions prior to 12.7.59, update to version 12.7.59 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-36869

Affected Products

Contactsprovider

References · 4

• https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36869 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36869 · Security Note
• https://t.me/cibsecurity/49496 · Telegram Post