Account
CVE-2022-30735
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_token without permission.
AnalysisAI
Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_token without permission. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_token without permission. Affected products include: Samsung Account. Version information: prior to 13.2.00.6.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.
Microsoft Account has a cross-site scripting vulnerability allowing unauthenticated attackers to execute scripts in the
Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android
Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access
Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version
Use of implicit intent for sensitive communication vulnerability in startSignIn in Samsung Account prior to version 14.5
Use of implicit intent for sensitive communication vulnerability in startNameValidationActivity in Samsung Account prior
Use of implicit intent for sensitive communication vulnerability in startMandatoryCheckActivity in Samsung Account prior
Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prio
Use of implicit intent for sensitive communication vulnerability in startAgreeToDisclaimerActivity in Samsung Account pr
Improper Handling of Insufficient Privileges in Samsung Account prior to version 14.8.00.3 allows local attackers to acc
Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitive
Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthori
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today