Read the docs
TI-2022-12871 Aliases CVE-2022-30736GHSA-fhhf-2x4r-9w4f

Information disclosure in Samsung Account

Priority LOW 24CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure, Privilege escalation
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-269.

Summary

Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission.

Why it matters now

EPSS 0.00421 36th percentileScored 2026-11-07
Fix Fixed Samsung Account (Samsung Mobile): 13.2.00.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungSamsung Accountbefore 13.2.00.613.2.00.6Patch availableCNA
  • Samsung Account VendorSamsung Affected before 13.2.00.6 Fixed in 13.2.00.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:samsung:account:*:*:*:*:*:*:*:*before 13.2.00.6VulnerableSamsung
  • cpe:2.3:a:samsung:account:*:*:*:*:*:*:*:* Versions before 13.2.00.6 Vulnerable ·Samsung

Remediation

  • Fix · CNA Samsung Account (Samsung Mobile) Fixed in 13.2.00.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Samsung Account 13.2.00.6

    8 records Highest priority Priority LOW 8 LOW

    Other records, highest priority first

    • TI-2022-12867 Information disclosure in Samsung AccountPriority LOW 34
    • TI-2022-12870 Information disclosure in Samsung AccountPriority LOW 33
    • TI-2022-12872 Implicit Intent hijacking vulnerability in Samsung Account prior to version 13.2.00.6 allows attackers to get email ID.Priority LOW 25
    Show all 8 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30736
  2. 2026-10-03 Alias added: GHSA-fhhf-2x4r-9w4f

References

Advisory 1

  • TI-2022-12867 Information disclosure in Samsung Account CVSS 3.1HIGH 7.5
  • TI-2023-07882 Improper URL input validation vulnerability in Samsung Account application prior to… CVSS 3.1HIGH 7.5
  • TI-2022-12870 Information disclosure in Samsung Account CVSS 3.1HIGH 7.5
  • TI-2021-07620 Improper authorization in Samsung Account CVSS 3.1HIGH 7.8
  • TI-2026-17011 URL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token. CVSS 4.0MEDIUM 6.9
  • TI-2023-22701 Exposure of resource to wrong sphere in Samsung Account CVSS 3.1MEDIUM 6.5
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences