Intent Hijacking Vulnerability in Samsung Pay
CVE-2022-36872

5MEDIUM

Key Information:

Vendor

Samsung
Status
Samsung Pay
Vendor
CVE Published:
9 September 2022

What is CVE-2022-36872?

The vulnerability in Samsung Pay arises from the SpayNotification component, which allows for pending Intent hijacking. This security flaw permits unauthorized access to files via implicit Intent, compromising user data and privacy. Users of Samsung Pay prior to specified versions are at risk and should seek updates to protect against potential exploitation.

Affected Version(s)

Samsung Pay < 5.0.63 for KR and 5.1.47 for Global

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2...
x_refsource_MISC

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.