description: Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.
problem types: CWE-285 Improper Authorization
affected:
{
product: Samsung Account
vendor: Samsung Mobile
versions:
lessThan: 10.8.0.4, status: affected, version: Android P(9.0) and below, versionType: custom
lessThan: 12.1.1.3, status: affected, version: Android Q(10.0) and above, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]