Improper Access Control in Samsung DeX Affects Multi-User Environments
CVE-2024-20802

4.6MEDIUM

Key Information:

Vendor
Samsung
Status
Samsung Mobile Devices
Vendor
CVE Published:
4 January 2024

Summary

An improper access control vulnerability exists in Samsung DeX, which allows the device owner to access notifications of other users in environments where multiple users are set up. This flaw poses significant risks as it undermines user privacy by enabling unauthorized access to personal notifications, highlighting the need for robust access control measures in multi-user scenarios.

Affected Version(s)

Samsung Mobile Devices SMR Jan-2024 Release in Selected Android 13 devices

References

https://security.samsungmobile.com/securityUpdate.smsb?ye...

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.