CVE-2023-21512 — Improper Privilege Management in Mobile Devices

CWE-269 — Improper Privilege Management CWE-276 — Incorrect Default Permissions3 documents3 sources

Severity

3.3LOWNVD

CNA2.4

EPSS

0.1%

top 78.40%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Samsung Mobile Devices Samsung Android

Timeline

PublishedJun 28

Description

Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without proper access permission.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5samsung_mobile/samsung_mobile_devicesAndroid 11, 12, 13 — SMR Jun-2023 Release 1

▶NVDsamsung/android11.0, 12.0, 13.0+2

🔴Vulnerability Details

CVEList

CVE-2023-21512: Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications↗2023-06-28

▶

GHSA

GHSA-86r2-66fg-x55c: Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications↗2023-06-28

▶