description: A vulnerability using PendingIntent in Bixby Routines prior to version 3.1.21.8 in Android R(11.0) and 2.6.30.5 in Android Q(10.0) allows attackers to execute privileged action by hijacking and modifying the intent.
problem types: CWE-94: Improper Control of Generation of Code ('Code Injection')
affected:
{
product: Bixby Routines
vendor: Samsung Mobile
versions:
lessThan: 3.1.21.8 in Android R(11.0) and 2.6.30.5 in Android Q(10.0), status: affected, version: -, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
]