CVE-2022-23433

Improper access control vulnerability in Reminder prior to versions 12.3.01.3000 in Android S(12), 12.2.05.6000 in Android R(11) and 11.6.08.6000 in Andoid Q(10) allows attackers to register reminders or execute exporeted activities remotely.

CVSS v3 4.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=2	Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=2	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:samsung:reminder:*:*:*:*:*:*:*:*

cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:a:samsung:reminder:*:*:*:*:*:*:*:*

cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:a:samsung:reminder:*:*:*:*:*:*:*:*

cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*

History

21 Nov 2024, 06:48

Type	Values Removed	Values Added
CVSS	v2 : ~~5.0~~ v3 : ~~5.3~~	v2 : 5.0 v3 : 4.3
References	~~() https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=2 - Vendor Advisory~~	() https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=2 - Vendor Advisory

27 Jun 2023, 19:02

Type	Values Removed	Values Added
CWE	~~CWE-863~~	NVD-CWE-Other

Information

Published : 2022-02-11 18:15

Updated : 2024-11-21 06:48

NVD link : CVE-2022-23433

Mitre link : CVE-2022-23433

CVE.ORG link : CVE-2022-23433

JSON object : View

Products Affected

samsung

reminder

google

android

CWE

CWE-284

Improper Access Control

NVD-CWE-Other

{"id": "CVE-2022-23433", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "mobile.security@samsung.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-02-11T18:15:11.693", "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=2", "tags": ["Vendor Advisory"], "source": "mobile.security@samsung.com"}, {"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=2", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "mobile.security@samsung.com", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Improper access control vulnerability in Reminder prior to versions 12.3.01.3000 in Android S(12), 12.2.05.6000 in Android R(11) and 11.6.08.6000 in Andoid Q(10) allows attackers to register reminders or execute exporeted activities remotely."}, {"lang": "es", "value": "Una vulnerabilidad de control de acceso inapropiado en Reminder versiones anteriores a 12.3.01.3000 en Android S(12), versiones 12.2.05.6000 en Android R(11) y versiones 11.6.08.6000 en Android Q(10), permite a atacantes registrar recordatorios o ejecutar actividades espor\u00e1dicas de forma remota"}], "lastModified": "2024-11-21T06:48:32.803", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samsung:reminder:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5A3E853-3C72-445F-9FFD-4F7ED4837225", "versionEndExcluding": "12.3.01.3000"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F8FB8EE9-FC56-4D5E-AE55-A5967634740C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samsung:reminder:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB00F034-86FE-4528-8402-0B56465EA448", "versionEndExcluding": "12.2.05.6000"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "109DD7FD-3A48-4C3D-8E1A-4433B98E1E64"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samsung:reminder:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DA0B0F8-F8C8-453D-8922-82BAAA77A05F", "versionEndExcluding": "11.6.08.6000"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D558D965-FA70-4822-A770-419E73BA9ED3"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "mobile.security@samsung.com"}