VulnerabilityModified

CVE-2022-28544

Path traversal vulnerability in unzip method of InstallAgentCommonHelper in Galaxy store prior to version 4.5.40.5 allows attacker to access the file of Galaxy store.

MEDIUM 5.5EPSS 0.90%

Does this matter?

Lower severity and a low EPSS score (0.90%). Track it; it rarely justifies an emergency change on its own.

Description

Path traversal vulnerability in unzip method of InstallAgentCommonHelper in Galaxy store prior to version 4.5.40.5 allows attacker to access the file of Galaxy store.

CVSS 3.1: 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.90% probability · 58th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: samsung/galaxy store
Source: mobile.security@samsung.com

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=4Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=4Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.