PT-2022-7126 · Samsung · Galaxy Store

Ken Gannon · Published 2022-12-05 · Updated 2023-02-17 · CVE-2023-21434

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Galaxy Store versions prior to 4.5.49.8

Description The issue exists due to inadequate protection of the web page structure, allowing an attacker to execute a JavaScript script when a web page is loaded. This is caused by an improper input validation vulnerability, which enables local attackers to launch a web page and execute JavaScript.

Recommendations For Galaxy Store versions prior to 4.5.49.8, update to version 4.5.49.8 or later to resolve the issue. As a temporary workaround, consider restricting the execution of JavaScript scripts within the Galaxy Store application to minimize the risk of exploitation.

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

BDU:2023-07686

CVE-2023-21434

Affected Products

Galaxy Store

References · 8

• https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-21434 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07686 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-21434 · Security Note
• https://t.me/cvenotify/44580 · Telegram Post
• https://t.me/true_secator/3972 · Telegram Post
• https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01 · Note
• https://research.nccgroup.com/2023/01/20/technical-advisory-multiple-vulnerabilities-in-the-galaxy-app-store-cve-2023-21433-cve-2023-21434 · Note