CVE-2022-22292 — Improper Handling of Insufficient Permissions or Privileges in Mobile Devices

CWE-280 — Improper Handling of Insufficient Permissions or Privileges3 documents3 sources

Severity

7.8HIGHNVD

CNA7.1

EPSS

0.0%

top 89.33%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Samsung Mobile Devices Google Android

Timeline

PublishedFeb 11

Latest updateFeb 12

Description

Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5samsung_mobile/samsung_mobile_devicesQ(10.0), R(11.0), S(12.0) — SMR Feb-2022 Release 1

▶NVDgoogle/android10.0, 11.0, 12.0+2

🔴Vulnerability Details

GHSA

GHSA-p2g7-259r-p245: Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity↗2022-02-12

▶

CVEList

CVE-2022-22292: Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity↗2022-02-11

▶