Details of VAR-201911-0564

ID

VAR-201911-0564

CVE

CVE-2019-15448

TITLE

Samsung S7 Edge Access Control Error Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2020-14774 // CNNVD: CNNVD-201911-953

DESCRIPTION

The Samsung S7 Edge Android device with a build fingerprint of samsung/hero2ltexx/hero2lte:8.0.0/R16NW/G935FXXS4ESC3:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app (versionCode=7000000, versionName=7.0.0.0) that allows other pre-installed apps to perform app installation via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app. Samsung S7 Edge Android Devices are vulnerable to improper assignment of permissions to critical resources.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Samsung S7 Edge is a smartphone from Samsung in South Korea. The Samsung S7 Edge has an access control error vulnerability. The vulnerability stems from a network system or product that did not properly restrict access to resources from unauthorized roles. An attacker could use this vulnerability to perform application installation through an accessible application component

Trust: 2.16

sources: NVD: CVE-2019-15448 // JVNDB: JVNDB-2019-012148 // CNVD: CNVD-2020-14774

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-14774

AFFECTED PRODUCTS

vendor:	samsung	model:	galaxy s7 edge	scope:	eq	version:	-	Trust: 1.0
vendor:	samsung	model:	galaxy s7 edge	scope:	-	version:	-	Trust: 0.8
vendor:	samsung	model:	s7 edge	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2020-14774 // JVNDB: JVNDB-2019-012148 // NVD: CVE-2019-15448

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-15448
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-15448
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-14774
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201911-953
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2019-15448
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2020-14774
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-15448
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-15448
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-14774 // JVNDB: JVNDB-2019-012148 // CNNVD: CNNVD-201911-953 // NVD: CVE-2019-15448

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-732	Trust: 0.8

sources: JVNDB: JVNDB-2019-012148 // NVD: CVE-2019-15448

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201911-953

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201911-953

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-012148

PATCH

title:

Galaxy S7 edge

url:

https://www.samsung.com/levant/smartphones/galaxy-s7-edge-g935f/

Trust: 0.8

sources: JVNDB: JVNDB-2019-012148

EXTERNAL IDS

db:	NVD	id:	CVE-2019-15448	Trust: 3.0
db:	JVNDB	id:	JVNDB-2019-012148	Trust: 0.8
db:	CNVD	id:	CNVD-2020-14774	Trust: 0.6
db:	CNNVD	id:	CNNVD-201911-953	Trust: 0.6

sources: CNVD: CNVD-2020-14774 // JVNDB: JVNDB-2019-012148 // CNNVD: CNNVD-201911-953 // NVD: CVE-2019-15448

REFERENCES

url:	https://www.kryptowire.com/android-firmware-2019/	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2019-15448	Trust: 2.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15448	Trust: 0.8

sources: CNVD: CNVD-2020-14774 // JVNDB: JVNDB-2019-012148 // CNNVD: CNNVD-201911-953 // NVD: CVE-2019-15448

SOURCES

db:	CNVD	id:	CNVD-2020-14774
db:	JVNDB	id:	JVNDB-2019-012148
db:	CNNVD	id:	CNNVD-201911-953
db:	NVD	id:	CVE-2019-15448

LAST UPDATE DATE

2024-11-23T22:11:46.505000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-14774	date:	2020-03-01T00:00:00
db:	JVNDB	id:	JVNDB-2019-012148	date:	2019-11-26T00:00:00
db:	CNNVD	id:	CNNVD-201911-953	date:	2020-09-02T00:00:00
db:	NVD	id:	CVE-2019-15448	date:	2024-11-21T04:28:45.377

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-14774	date:	2020-03-01T00:00:00
db:	JVNDB	id:	JVNDB-2019-012148	date:	2019-11-26T00:00:00
db:	CNNVD	id:	CNNVD-201911-953	date:	2019-11-14T00:00:00
db:	NVD	id:	CVE-2019-15448	date:	2019-11-14T17:15:23.053