Account
CVE-2022-30739
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get an user email or phone number with a normal level permission.
AnalysisAI
Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get an user email or phone number with a normal level permission. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get an user email or phone number with a normal level permission. Affected products include: Samsung Account. Version information: prior to 13.2.00.6.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.
Microsoft Account has a cross-site scripting vulnerability allowing unauthenticated attackers to execute scripts in the
Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android
Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_tok
Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access
Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version
Use of implicit intent for sensitive communication vulnerability in startSignIn in Samsung Account prior to version 14.5
Use of implicit intent for sensitive communication vulnerability in startNameValidationActivity in Samsung Account prior
Use of implicit intent for sensitive communication vulnerability in startMandatoryCheckActivity in Samsung Account prior
Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prio
Use of implicit intent for sensitive communication vulnerability in startAgreeToDisclaimerActivity in Samsung Account pr
Improper Handling of Insufficient Privileges in Samsung Account prior to version 14.8.00.3 allows local attackers to acc
Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitive
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today