CVE-2022-28791

CWE-20 — Improper Input Validation3 documents3 sources
Severity
5.5MEDIUM
EPSS
0.1%
top 75.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Samsung Mobile Galaxy StoreSamsung Galaxy Store
Timeline
PublishedMay 3
Latest updateMay 4

Description

Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4.5.41.8 allows attacker to overwrite files stored in a specific path. The patch adds proper protection to prevent overwrite to existing files.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.5 | Impact: 3.6

Affected Packages2 packages

▶NVDsamsung/galaxy_store< 4.5.41.8
▶CVEListV5samsung_mobile/galaxy_store- — 4.5.41.3

🔴Vulnerability Details

2
GHSA
GHSA-3247-33gc-rgpq: Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4↗2022-05-04
▶
CVEList
CVE-2022-28791: Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4↗2022-05-03
▶
CVE-2022-28791 (MEDIUM CVSS 5.5) | Improper input validation vulnerabi | cvebase.io