CVE-2023-21449 — Sensitive Information Exposure in Mobile Devices

CWE-200 — Sensitive Information Exposure3 documents3 sources

Severity

5.5MEDIUMNVD

CNA4.0

EPSS

0.1%

top 83.11%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Samsung Mobile Devices Samsung Android

Timeline

PublishedMar 16

Description

Improper access control vulnerability in Call application prior to SMR Mar-2023 Release 1 allows local attackers to access sensitive information without proper permission.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5samsung_mobile/samsung_mobile_devicesSelect Android 11, 12 devices — SMR Mar-2023 Release 1

▶NVDsamsung/android11.0, 12.0+1

🔴Vulnerability Details

GHSA

GHSA-2pwm-63gm-7654: Improper access control vulnerability in Call application prior to SMR Mar-2023 Release 1 allows local attackers to access sensitive information witho↗2023-03-16

▶

CVEList

CVE-2023-21449: Improper access control vulnerability in Call application prior to SMR Mar-2023 Release 1 allows local attackers to access sensitive information witho↗2023-03-16

▶