Paper/Archive/CVE-2023-42580

CVE-2023-42580

Samsung Mobile Galaxy Store — Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to i…

EPSS 1.0%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 61.9.619 × 2012.4 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to install APK from Galaxy Store.

Affected

ProductAffectedFixed inSource

Galaxy Storesee advisory4.5.64.4CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SamsungMobile (CNA)7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

refsecurity.samsungmobile.com/serviceWeb.smsb?year=2023&month=12