CVE-2024-34601 - OpenCVE

Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launch unexported activities of GalaxyStore.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Samsung	Galaxystore

Configuration 1 [-]

cpe:2.3:a:samsung:galaxystore:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07

History

No history.

MITRE

Status: PUBLISHED

Assigner: SamsungMobile

Published: 2024-07-02T09:23:41.774Z

Updated: 2024-08-02T02:59:21.745Z

Reserved: 2024-05-07T04:43:27.829Z

Link: CVE-2024-34601

Vulnrichment

Updated: 2024-08-02T02:59:21.745Z

NVD

Status : Analyzed

Published: 2024-07-02T10:15:08.980

Modified: 2024-07-02T18:07:05.737

Link: CVE-2024-34601

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-34601", "assignerOrgId": "3af57064-a867-422c-b2ad-40307b65c458", "state": "PUBLISHED", "assignerShortName": "SamsungMobile", "dateReserved": "2024-05-07T04:43:27.829Z", "datePublished": "2024-07-02T09:23:41.774Z", "dateUpdated": "2024-08-02T02:59:21.745Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-925 : Improper Verification of Intent by Broadcast Receiver"}]}], "affected": [{"vendor": "Samsung Mobile", "product": "GalaxyStore", "versions": [{"status": "unaffected", "version": "4.5.81.0"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launch unexported activities of GalaxyStore."}], "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}], "providerMetadata": {"orgId": "3af57064-a867-422c-b2ad-40307b65c458", "shortName": "SamsungMobile", "dateUpdated": "2024-07-02T09:23:41.774Z"}}, "adp": [{"affected": [{"vendor": "samsung_mobile", "product": "galaxystore", "cpes": ["cpe:2.3:a:samsung_mobile:galaxystore:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "4.5.81.0", "status": "unaffected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-02T14:56:59.979186Z", "id": "CVE-2024-34601", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T15:08:59.366Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:59:21.745Z"}, "title": "CVE Program Container", "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:59:21.745Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-34601", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-02T14:56:59.979186Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:samsung_mobile:galaxystore:*:*:*:*:*:*:*:*"], "vendor": "samsung_mobile", "product": "galaxystore", "versions": [{"status": "unaffected", "version": "4.5.81.0"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T14:59:31.605Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Samsung Mobile", "product": "GalaxyStore", "versions": [{"status": "unaffected", "version": "4.5.81.0"}], "defaultStatus": "affected"}], "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07"}], "descriptions": [{"lang": "en", "value": "Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launch unexported activities of GalaxyStore."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-925 : Improper Verification of Intent by Broadcast Receiver"}]}], "providerMetadata": {"orgId": "3af57064-a867-422c-b2ad-40307b65c458", "shortName": "SamsungMobile", "dateUpdated": "2024-07-02T09:23:41.774Z"}}}, "cveMetadata": {"cveId": "CVE-2024-34601", "state": "PUBLISHED", "dateUpdated": "2024-08-02T02:59:21.745Z", "dateReserved": "2024-05-07T04:43:27.829Z", "assignerOrgId": "3af57064-a867-422c-b2ad-40307b65c458", "datePublished": "2024-07-02T09:23:41.774Z", "assignerShortName": "SamsungMobile"}, "dataVersion": "5.1"}