Sign-up

ID

VAR-201911-0558


CVE

CVE-2019-15442


TITLE

Samsung on7xelteskt Access Control Error Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2020-14773 // CNNVD: CNNVD-201911-946

DESCRIPTION

The Samsung on7xelteskt Android device with a build fingerprint of samsung/on7xelteskt/on7xelteskt:8.1.0/M1AJQ/G610SKSU2CSB1:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app (versionCode=7000100, versionName=7.0.1.0) that allows other pre-installed apps to perform app installation via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app. Samsung on7xelteskt Android Devices are vulnerable to improper assignment of permissions to critical resources.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Samsung on7xelteskt is a smartphone from Samsung in South Korea. Samsung on7xelteskt has an access control error vulnerability. The vulnerability stems from a network system or product that did not properly restrict access to resources from unauthorized roles. An attacker could use this vulnerability to perform application installation through an accessible application component

Trust: 2.16

sources: NVD: CVE-2019-15442 // JVNDB: JVNDB-2019-012410 // CNVD: CNVD-2020-14773

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-14773

AFFECTED PRODUCTS

vendor:samsungmodel:on 7scope:eqversion: -

Trust: 1.0

vendor:samsungmodel:galaxy on7scope: - version: -

Trust: 0.8

vendor:samsungmodel:on7xeltesktscope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2020-14773 // JVNDB: JVNDB-2019-012410 // NVD: CVE-2019-15442

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-15442
value: HIGH

Trust: 1.0

NVD: CVE-2019-15442
value: HIGH

Trust: 0.8

CNVD: CNVD-2020-14773
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201911-946
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2019-15442
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2020-14773
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2019-15442
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2019-15442
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-14773 // JVNDB: JVNDB-2019-012410 // CNNVD: CNNVD-201911-946 // NVD: CVE-2019-15442

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-732

Trust: 0.8

sources: JVNDB: JVNDB-2019-012410 // NVD: CVE-2019-15442

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201911-946

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201911-946

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-012410

PATCH
title:Top Pageurl:https://www.samsung.com/us/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2019-012410

EXTERNAL IDS
db:NVDid:CVE-2019-15442
Trust: 3.0
db:JVNDBid:JVNDB-2019-012410
Trust: 0.8
db:CNVDid:CNVD-2020-14773
Trust: 0.6
db:CNNVDid:CNNVD-201911-946
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-14773 // 
            
            
            
            JVNDB: JVNDB-2019-012410 // 
            
            
            
            CNNVD: CNNVD-201911-946 // 
            
            
            
            NVD: CVE-2019-15442

REFERENCES
url:https://www.kryptowire.com/android-firmware-2019/
Trust: 2.4
url:https://nvd.nist.gov/vuln/detail/cve-2019-15442
Trust: 2.0
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15442
Trust: 0.8
sources:
            
            
            CNVD: CNVD-2020-14773 // 
            
            
            
            JVNDB: JVNDB-2019-012410 // 
            
            
            
            CNNVD: CNNVD-201911-946 // 
            
            
            
            NVD: CVE-2019-15442

SOURCES
db:CNVDid:CNVD-2020-14773
db:JVNDBid:JVNDB-2019-012410
db:CNNVDid:CNNVD-201911-946
db:NVDid:CVE-2019-15442

LAST UPDATE DATE
2024-11-23T22:05:56.896000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-14773date:2020-03-01T00:00:00
db:JVNDBid:JVNDB-2019-012410date:2019-12-02T00:00:00
db:CNNVDid:CNNVD-201911-946date:2020-08-25T00:00:00
db:NVDid:CVE-2019-15442date:2024-11-21T04:28:44.530

SOURCES RELEASE DATE
db:CNVDid:CNVD-2020-14773date:2020-03-01T00:00:00
db:JVNDBid:JVNDB-2019-012410date:2019-12-02T00:00:00
db:CNNVDid:CNNVD-201911-946date:2019-11-14T00:00:00
db:NVDid:CVE-2019-15442date:2019-11-14T17:15:22.663