VulnerabilityModified

CVE-2023-21434

Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching a web page.

MEDIUM 6.1EPSS 12.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 12.9%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching a web page.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 12.88% probability · 96th percentile
CISA KEV: Not listed
Weakness: CWE-20, CWE-79
Affected: samsung/galaxy store
Source: mobile.security@samsung.com

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.