Details of VAR-201911-0566

ID

VAR-201911-0566

CVE

CVE-2019-15450

TITLE

Samsung j3popeltecan Access Control Error Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2020-14776 // CNNVD: CNNVD-201911-952

DESCRIPTION

The Samsung j3popeltecan Android device with a build fingerprint of samsung/j3popeltevl/j3popeltecan:8.1.0/M1AJQ/J327WVLS3BSA2:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app (versionCode=7000100, versionName=7.0.1.0) that allows other pre-installed apps to perform app installation via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app. Samsung j7popeltemtr Android Devices are vulnerable to improper assignment of permissions to critical resources.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Samsung j3popeltecan is a smartphone from Samsung in South Korea. Samsung j3popeltecan has an access control error vulnerability. The vulnerability stems from a network system or product that did not properly restrict access to resources from unauthorized roles. An attacker could use this vulnerability to perform application installation through an accessible application component

Trust: 2.16

sources: NVD: CVE-2019-15450 // JVNDB: JVNDB-2019-012411 // CNVD: CNVD-2020-14776

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-14776

AFFECTED PRODUCTS

vendor:	samsung	model:	galaxy j3 pop	scope:	eq	version:	-	Trust: 1.0
vendor:	samsung	model:	galaxy j3 pop	scope:	-	version:	-	Trust: 0.8
vendor:	samsung	model:	j3popeltecan	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2020-14776 // JVNDB: JVNDB-2019-012411 // NVD: CVE-2019-15450

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-15450
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-15450
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-14776
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201911-952
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2019-15450
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2020-14776
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-15450
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-15450
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-14776 // JVNDB: JVNDB-2019-012411 // CNNVD: CNNVD-201911-952 // NVD: CVE-2019-15450

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-732	Trust: 0.8

sources: JVNDB: JVNDB-2019-012411 // NVD: CVE-2019-15450

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201911-952

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201911-952

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-012411

PATCH

title:

Galaxy J3

url:

https://www.samsung.com/us/mobile/phones/all-other-phones/galaxy-j3--us-cellular--sm-j327rzkzusc/

Trust: 0.8

sources: JVNDB: JVNDB-2019-012411

EXTERNAL IDS

db:	NVD	id:	CVE-2019-15450	Trust: 3.0
db:	JVNDB	id:	JVNDB-2019-012411	Trust: 0.8
db:	CNVD	id:	CNVD-2020-14776	Trust: 0.6
db:	CNNVD	id:	CNNVD-201911-952	Trust: 0.6

sources: CNVD: CNVD-2020-14776 // JVNDB: JVNDB-2019-012411 // CNNVD: CNNVD-201911-952 // NVD: CVE-2019-15450

REFERENCES

url:	https://www.kryptowire.com/android-firmware-2019/	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2019-15450	Trust: 2.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15450	Trust: 0.8

sources: CNVD: CNVD-2020-14776 // JVNDB: JVNDB-2019-012411 // CNNVD: CNNVD-201911-952 // NVD: CVE-2019-15450

SOURCES

db:	CNVD	id:	CNVD-2020-14776
db:	JVNDB	id:	JVNDB-2019-012411
db:	CNNVD	id:	CNNVD-201911-952
db:	NVD	id:	CVE-2019-15450

LAST UPDATE DATE

2024-11-23T22:21:24.588000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-14776	date:	2020-03-01T00:00:00
db:	JVNDB	id:	JVNDB-2019-012411	date:	2019-12-02T00:00:00
db:	CNNVD	id:	CNNVD-201911-952	date:	2020-09-02T00:00:00
db:	NVD	id:	CVE-2019-15450	date:	2024-11-21T04:28:45.670

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-14776	date:	2020-03-01T00:00:00
db:	JVNDB	id:	JVNDB-2019-012411	date:	2019-12-02T00:00:00
db:	CNNVD	id:	CNNVD-201911-952	date:	2019-11-14T00:00:00
db:	NVD	id:	CVE-2019-15450	date:	2019-11-14T17:15:23.193