Pending Intent Hijacking Vulnerability in Samsung Pay
CVE-2022-36870

5MEDIUM

Key Information:

Vendor

Samsung
Status
Samsung Pay
Vendor
CVE Published:
9 September 2022

What is CVE-2022-36870?

A pending intent hijacking vulnerability exists in the MTransferNotificationManager component of Samsung Pay. This flaw allows attackers to exploit implicit intents, which can enable unauthorized file access without the necessary permissions. This issue impacts versions of Samsung Pay prior to 5.0.63 for South Korea and 5.1.47 for global users. It emphasizes the importance of secure intent handling within mobile applications.

Affected Version(s)

Samsung Pay < 5.0.63 for KR and 5.1.47 for Global

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2...
x_refsource_MISC

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.