Privilege Escalation Vulnerability in Samsung Email Application
CVE-2018-10497

7.8HIGH

Key Information:

Vendor
Samsung
Status
Samsung Email
Vendor
CVE Published:
24 September 2018

Summary

This vulnerability in Samsung Email allows local attackers to escalate privileges by exploiting a flaw in the handling of EML files. The issue arises from inadequate validation of user-supplied data, permitting arbitrary JavaScript execution. To exploit this vulnerability, an attacker must first execute low-privileged code on the target device, thus gaining access to restricted resources within the application. The flaw was documented as ZDI-CAN-5328 and remedied in version 5.0.02.16.

Affected Version(s)

Samsung Email Fixed in version 5.0.02.16

References

https://zerodayinitiative.com/advisories/ZDI-18-556
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.