Paper/Archive/CVE-2023-21516

CVE-2023-21516

Samsung Mobile Galaxy Store — XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK fr…

EPSS 0.5%CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (NVD)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 46.0.460 × 209.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.

Affected

ProductAffectedFixed inSource

Galaxy Storeunspecified – < 4.5.49.84.5.49.8CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Samsung Mobile (CNA)7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refsecurity.samsungmobile.com/serviceWeb.smsb?year=2023&month=01