description: Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in Android Q(10.0) and 2.9.01.1 in Android R(11.0) allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.
problem types: CWE-285 Improper Authorization
affected:
{
product: Customization Service
vendor: Samsung Mobile
versions:
lessThan: 2.2.02.1, status: affected, version: Android O(8.x), versionType: custom
lessThan: 2.4.03.0, status: affected, version: Android P(9.0), versionType: custom
lessThan: 2.7.02.1, status: affected, version: Android Q(10.0), versionType: custom
lessThan: 2.9.01.1, status: affected, version: Android R(11.0), versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]