Details of VAR-201911-0554

ID

VAR-201911-0554

CVE

CVE-2019-15438

TITLE

Samsung XCover4 Android Vulnerability with improper permission assignment to critical resources on devices

Trust: 0.8

sources: JVNDB: JVNDB-2019-012165

DESCRIPTION

The Samsung XCover4 Android device with a build fingerprint of samsung/xcover4ltedo/xcover4lte:8.1.0/M1AJQ/G390YDXU2BSA1:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app (versionCode=7000100, versionName=7.0.1.0) that allows other pre-installed apps to perform app installation via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app. Samsung XCover4 Android Devices are vulnerable to improper assignment of permissions to critical resources.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Samsung XCover4 is a smartphone from Samsung in South Korea. Samsung XCover4 has an access control error vulnerability. The vulnerability stems from a network system or product that did not properly restrict access to resources from unauthorized roles. An attacker could use this vulnerability to perform application installation through an accessible application component. The Samsung XCover4 Android device could allow a physical malicious user to gain elevated privileges on the system. An attacker could exploit this vulnerability to gain elevated privileges on the system

Trust: 2.25

sources: NVD: CVE-2019-15438 // JVNDB: JVNDB-2019-012165 // CNVD: CNVD-2020-14780 // VULMON: CVE-2019-15438

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-14780

AFFECTED PRODUCTS

vendor:	samsung	model:	galaxy xcover4	scope:	eq	version:	-	Trust: 1.0
vendor:	samsung	model:	galaxy xcover 4	scope:	-	version:	-	Trust: 0.8
vendor:	samsung	model:	xcover4	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2020-14780 // JVNDB: JVNDB-2019-012165 // NVD: CVE-2019-15438

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-15438
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-15438
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-14780
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201911-944
value:	HIGH
Trust: 0.6
VULMON:	CVE-2019-15438
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-15438
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2020-14780
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-15438
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-15438
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-14780 // VULMON: CVE-2019-15438 // JVNDB: JVNDB-2019-012165 // CNNVD: CNNVD-201911-944 // NVD: CVE-2019-15438

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-732	Trust: 0.8

sources: JVNDB: JVNDB-2019-012165 // NVD: CVE-2019-15438

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201911-944

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201911-944

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-012165

PATCH

title:

Galaxy XCover 4

url:

https://www.samsung.com/uk/smartphones/galaxy-xcover4-g390f/

Trust: 0.8

sources: JVNDB: JVNDB-2019-012165

EXTERNAL IDS

db:	NVD	id:	CVE-2019-15438	Trust: 3.1
db:	JVNDB	id:	JVNDB-2019-012165	Trust: 0.8
db:	CNVD	id:	CNVD-2020-14780	Trust: 0.6
db:	CNNVD	id:	CNNVD-201911-944	Trust: 0.6
db:	VULMON	id:	CVE-2019-15438	Trust: 0.1

sources: CNVD: CNVD-2020-14780 // VULMON: CVE-2019-15438 // JVNDB: JVNDB-2019-012165 // CNNVD: CNNVD-201911-944 // NVD: CVE-2019-15438

REFERENCES

url:	https://www.kryptowire.com/android-firmware-2019/	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2019-15438	Trust: 2.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15438	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/171652	Trust: 0.1

sources: CNVD: CNVD-2020-14780 // VULMON: CVE-2019-15438 // JVNDB: JVNDB-2019-012165 // CNNVD: CNNVD-201911-944 // NVD: CVE-2019-15438

SOURCES

db:	CNVD	id:	CNVD-2020-14780
db:	VULMON	id:	CVE-2019-15438
db:	JVNDB	id:	JVNDB-2019-012165
db:	CNNVD	id:	CNNVD-201911-944
db:	NVD	id:	CVE-2019-15438

LAST UPDATE DATE

2024-11-23T22:41:18.090000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-14780	date:	2020-03-01T00:00:00
db:	VULMON	id:	CVE-2019-15438	date:	2020-08-24T00:00:00
db:	JVNDB	id:	JVNDB-2019-012165	date:	2019-11-26T00:00:00
db:	CNNVD	id:	CNNVD-201911-944	date:	2020-08-25T00:00:00
db:	NVD	id:	CVE-2019-15438	date:	2024-11-21T04:28:43.953

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-14780	date:	2020-03-01T00:00:00
db:	VULMON	id:	CVE-2019-15438	date:	2019-11-14T00:00:00
db:	JVNDB	id:	JVNDB-2019-012165	date:	2019-11-26T00:00:00
db:	CNNVD	id:	CNNVD-201911-944	date:	2019-11-14T00:00:00
db:	NVD	id:	CVE-2019-15438	date:	2019-11-14T17:15:22.380