CVE-2022-33699 — Sensitive Information Exposure in Mobile Devices

CWE-200 — Sensitive Information Exposure CWE-668 — Resource Exposure3 documents3 sources

Severity

2.3LOWNVD

CNA2.0

EPSS

0.0%

top 95.91%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Samsung Mobile Devices Google Android

Timeline

PublishedJul 12

Latest updateJul 13

Description

Exposure of Sensitive Information in getDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via log.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NExploitability: 0.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5samsung_mobile/samsung_mobile_devicesQ(10), R(11), S(12) — SMR Jul-2022 Release 1

▶NVDgoogle/android10.0, 11.0, 12.0+2

🔴Vulnerability Details

GHSA

GHSA-3m9q-9522-7fx6: Exposure of Sensitive Information in getDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via log↗2022-07-13

▶

CVEList

CVE-2022-33699: Exposure of Sensitive Information in getDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via log↗2022-07-11

▶