CVE-2024-34597

Improper input validation in Samsung Health prior to version 6.27.0.113 allows local attackers to write arbitrary document files to the sandbox of Samsung Health. User interaction is required for triggering this vulnerability.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:samsung:health:*:*:*:*:*:*:*:*

History

02 Jul 2024, 18:04

Type	Values Removed	Values Added
CPE		cpe:2.3:a:samsung:health::::::::
References	~~() https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07 -~~	() https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~4.4~~	v2 : unknown v3 : 3.3
CWE		NVD-CWE-noinfo
First Time		Samsung Samsung health

02 Jul 2024, 12:09

Type	Values Removed	Values Added
Summary		(es) La validación de entrada incorrecta en Samsung Health anterior a la versión 6.27.0.113 permite a atacantes locales escribir archivos de documentos arbitrarios en la sandbox de Samsung Health. Se requiere la interacción del usuario para activar esta vulnerabilidad.

02 Jul 2024, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-02 10:15

Updated : 2024-07-02 18:04

NVD link : CVE-2024-34597

Mitre link : CVE-2024-34597

CVE.ORG link : CVE-2024-34597

JSON object : View

Products Affected

samsung

health

CWE

NVD-CWE-noinfo

{"id": "CVE-2024-34597", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "mobile.security@samsung.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 1.8}]}, "published": "2024-07-02T10:15:08.487", "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07", "tags": ["Vendor Advisory"], "source": "mobile.security@samsung.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Improper input validation in Samsung Health prior to version 6.27.0.113 allows local attackers to write arbitrary document files to the sandbox of Samsung Health. User interaction is required for triggering this vulnerability."}, {"lang": "es", "value": "La validaci\u00f3n de entrada incorrecta en Samsung Health anterior a la versi\u00f3n 6.27.0.113 permite a atacantes locales escribir archivos de documentos arbitrarios en la sandbox de Samsung Health. Se requiere la interacci\u00f3n del usuario para activar esta vulnerabilidad."}], "lastModified": "2024-07-02T18:04:57.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samsung:health:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72946B1F-4F1C-4AEF-BB97-6E91D10365C5", "versionEndExcluding": "6.27.0.113"}], "operator": "OR"}]}], "sourceIdentifier": "mobile.security@samsung.com"}