Details of VAR-201911-0550

ID

VAR-201911-0550

CVE

CVE-2019-15434

TITLE

Samsung A5 Access Control Error Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2020-14778 // CNNVD: CNNVD-201911-939

DESCRIPTION

The Samsung A5 Android device with a build fingerprint of samsung/a5y17ltexx/a5y17lte:8.0.0/R16NW/A520FXXS8CSC5:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app (versionCode=7000000, versionName=7.0.0.0) that allows other pre-installed apps to perform app installation via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app. Samsung A5 Android The device is vulnerable to improper assignment of permissions to critical resources.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Samsung A5 is a smartphone from Samsung in South Korea. The Samsung A5 has an access control error vulnerability. The vulnerability stems from a network system or product that did not properly restrict access to resources from unauthorized roles. An attacker could use this vulnerability to perform application installation through an accessible application component

Trust: 2.25

sources: NVD: CVE-2019-15434 // JVNDB: JVNDB-2019-012195 // CNVD: CNVD-2020-14778 // VULMON: CVE-2019-15434

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-14778

AFFECTED PRODUCTS

vendor:	samsung	model:	galaxy a5	scope:	eq	version:	-	Trust: 1.0
vendor:	samsung	model:	galaxy a5	scope:	-	version:	-	Trust: 0.8
vendor:	samsung	model:	a5	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2020-14778 // JVNDB: JVNDB-2019-012195 // NVD: CVE-2019-15434

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-15434
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-15434
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-14778
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201911-939
value:	HIGH
Trust: 0.6
VULMON:	CVE-2019-15434
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-15434
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2020-14778
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-15434
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-15434
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-14778 // VULMON: CVE-2019-15434 // JVNDB: JVNDB-2019-012195 // CNNVD: CNNVD-201911-939 // NVD: CVE-2019-15434

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-732	Trust: 0.8

sources: JVNDB: JVNDB-2019-012195 // NVD: CVE-2019-15434

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201911-939

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201911-939

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-012195

PATCH

title:

Galaxy A5

url:

https://www.samsung.com/au/smartphones/galaxy-a5-a520f/SM-A520FZKAXSA/

Trust: 0.8

sources: JVNDB: JVNDB-2019-012195

EXTERNAL IDS

db:	NVD	id:	CVE-2019-15434	Trust: 3.1
db:	JVNDB	id:	JVNDB-2019-012195	Trust: 0.8
db:	CNVD	id:	CNVD-2020-14778	Trust: 0.6
db:	CNNVD	id:	CNNVD-201911-939	Trust: 0.6
db:	VULMON	id:	CVE-2019-15434	Trust: 0.1

sources: CNVD: CNVD-2020-14778 // VULMON: CVE-2019-15434 // JVNDB: JVNDB-2019-012195 // CNNVD: CNNVD-201911-939 // NVD: CVE-2019-15434

REFERENCES

url:	https://www.kryptowire.com/android-firmware-2019/	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2019-15434	Trust: 2.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15434	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2020-14778 // VULMON: CVE-2019-15434 // JVNDB: JVNDB-2019-012195 // CNNVD: CNNVD-201911-939 // NVD: CVE-2019-15434

SOURCES

db:	CNVD	id:	CNVD-2020-14778
db:	VULMON	id:	CVE-2019-15434
db:	JVNDB	id:	JVNDB-2019-012195
db:	CNNVD	id:	CNNVD-201911-939
db:	NVD	id:	CVE-2019-15434

LAST UPDATE DATE

2024-11-23T22:51:37.321000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-14778	date:	2020-03-01T00:00:00
db:	VULMON	id:	CVE-2019-15434	date:	2020-08-24T00:00:00
db:	JVNDB	id:	JVNDB-2019-012195	date:	2019-11-27T00:00:00
db:	CNNVD	id:	CNNVD-201911-939	date:	2020-08-25T00:00:00
db:	NVD	id:	CVE-2019-15434	date:	2024-11-21T04:28:43.367

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-14778	date:	2020-03-01T00:00:00
db:	VULMON	id:	CVE-2019-15434	date:	2019-11-14T00:00:00
db:	JVNDB	id:	JVNDB-2019-012195	date:	2019-11-27T00:00:00
db:	CNNVD	id:	CNNVD-201911-939	date:	2019-11-14T00:00:00
db:	NVD	id:	CVE-2019-15434	date:	2019-11-14T17:15:22.083