Improper Access Control in Samsung Members Affects Android Devices
CVE-2021-25438

7.8HIGH

Key Information:

Vendor

Samsung
Status
Samsung Members
Vendor
CVE Published:
8 July 2021

What is CVE-2021-25438?

A vulnerability in the Samsung Members application allows untrusted applications to exploit improper access controls, potentially leading to local file inclusion in the WebView component. This impacts users of specific versions of Samsung Members under Android O and P, posing risks to user data and application integrity. Addressing this vulnerability is crucial for ensuring robust security on affected devices.

Affected Version(s)

Samsung Members - < 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.