Skip to main content

Galaxy Store CVE-2021-25499

MEDIUM
Improper Authorization (CWE-285)
2021-10-06 mobile.security@samsung.com
Authentication Bypass Galaxy Store
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Oct 06, 2021 - 18:15 nvd
MEDIUM 5.5

DescriptionNVD

Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of Galaxy Store.

AnalysisAI

Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of Galaxy Store. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-285. Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of Galaxy Store. Affected products include: Samsung Galaxy Store. Version information: version 4.5.32.4.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Galaxy Store

View all
CVE-2023-42580 CRITICAL
9.8 Dec 05

Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute Ja
CVE-2023-21516 CRITICAL
9.6 May 26

XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API

CVE-2023-21515 HIGH
8.8 May 26

InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 al
CVE-2023-21514 HIGH
8.8 May 26

Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execu
CVE-2026-20976 HIGH
7.8 Jan 09

Galaxy Store versions up to 4.6.02 contains a vulnerability that allows attackers to execute arbitrary script (CVSS 7.8)
CVE-2023-21433 HIGH
7.8 Feb 09

Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applic
CVE-2022-33710 HIGH
7.8 Jul 12

Improper input validation vulnerability in BillingPackageInsraller in Galaxy Store prior to version 4.5.41.8 allows loca
CVE-2022-33709 HIGH
7.8 Jul 12

Improper input validation vulnerability in ApexPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local a
CVE-2022-33708 HIGH
7.8 Jul 12

Improper input validation vulnerability in AppsPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local a
CVE-2022-28776 HIGH
7.8 Apr 11

Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications

CVE-2023-42581 HIGH
7.5 Dec 05

Improper URL validation from InstantPlay deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute

CVE-2026-21000 HIGH
7.0 Mar 16

Galaxy Store versions prior to 4.6.03.8 contain an access control flaw that enables local attackers to create files with

Same weakness CWE-285 – Improper Authorization

View all
CVE-2025-29927 CRITICAL POC
9.1
CVE-2016-5676 HIGH POC
7.5
CVE-2025-66301 CRITICAL POC
9.6
CVE-2023-32707 HIGH POC
8.8
CVE-2016-3352 HIGH
8.8
CVE-2025-29659 CRITICAL POC
9.8
CVE-2022-2595 CRITICAL POC
10.0
CVE-2026-30956 CRITICAL POC
9.9

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2021-25499 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy