CVE-2021-25351

EPSS 0.05%
Veröffentlicht 25.03.2021 17:15:13
Zuletzt bearbeitet 21.11.2024 05:54:49
Quelle mobile.security@samsung.com
CVE-Watchlists
Login
Unerledigt
Login

Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attackers to log out user account on device without user password.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Samsung ≫ Account Version < 10.7.07

Google ≫ Android Version9.0

Samsung ≫ Account Version < 12.1.1.3

Google ≫ Android Version10.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.05%	0.15

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	2.4	0.9	1.4	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvd@nist.gov	2.1	3.9	2.9	AV:L/AC:L/Au:N/C:N/I:P/A:N
mobile.security@samsung.com	3.2	0.7	2.5	CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

https://security.samsungmobile.com/serviceWeb.smsb

Vendor Advisory

https://security.samsungmobile.com/

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2021-25351

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-25351

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-25351

EUVD