CVE-2021-25351

CVSS v3 3.2 LOW
CVSS v2.0 2.1 LOW

3.2^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.7 / Impact : 2.5

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

I

mproper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attackers to log out user account on device without user password.

References

Link	Resource
https://security.samsungmobile.com/	Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb	Vendor Advisory
https://security.samsungmobile.com/	Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:samsung:account:*:*:*:*:*:*:*:*

cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:a:samsung:account:*:*:*:*:*:*:*:*

cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*

History

21 Nov 2024, 05:54

Type	Values Removed	Values Added
References	~~() https://security.samsungmobile.com/ - Vendor Advisory~~	() https://security.samsungmobile.com/ - Vendor Advisory
References	~~() https://security.samsungmobile.com/serviceWeb.smsb - Vendor Advisory~~	() https://security.samsungmobile.com/serviceWeb.smsb - Vendor Advisory
CVSS	v2 : ~~2.1~~ v3 : ~~2.4~~	v2 : 2.1 v3 : 3.2

Information

Published : 2021-03-25 17:15

Updated : 2024-11-21 05:54

NVD link : CVE-2021-25351

Mitre link : CVE-2021-25351

CVE.ORG link : CVE-2021-25351

JSON object : View

Products Affected

android

account

CWE

CWE-285

Improper Authorization

NVD-CWE-Other

{"id": "CVE-2021-25351", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "[email protected]", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.2, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 0.7}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.9}]}, "published": "2021-03-25T17:15:13.507", "references": [{"url": "https://security.samsungmobile.com/", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://security.samsungmobile.com/serviceWeb.smsb", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://security.samsungmobile.com/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.samsungmobile.com/serviceWeb.smsb", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-285"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attackers to log out user account on device without user password."}, {"lang": "es", "value": "Un control de acceso inapropiado en la funci\u00f3n EmailValidationView en Samsung Account versiones anteriores a 10.7.0.7 y 12.1.1.3, permite a atacantes cercanos f\u00edsicamente cerrar la sesi\u00f3n de la cuenta de usuario en el dispositivo sin contrase\u00f1a de usuario"}], "lastModified": "2024-11-21T05:54:49.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samsung:account:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E76E290-260D-40F4-BF8E-375687CBC3A1", "versionEndExcluding": "10.7.07"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8DFAAD08-36DA-4C95-8200-C29FE5B6B854"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samsung:account:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B61EDFA-84A2-4066-BA9E-4B77D1D808F4", "versionEndExcluding": "12.1.1.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D558D965-FA70-4822-A770-419E73BA9ED3"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}