Read the docs
TI-2022-14823 Aliases CVE-2022-33705GHSA-g29h-g6jc-79fj

Improper authorization in Samsung Calendar

Priority LOW 15CWE-285Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

Information exposure in Calendar prior to version 12.3.05.10000 allows attacker to access calendar schedule without READ_CALENDAR permission.

Why it matters now

EPSS 0.00204 10th percentileScored 2026-11-07
Fix Fixed Calendar (Samsung Mobile): 12.3.05.10000

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungCalendarbefore 12.3.05.1000012.3.05.10000Patch availableCNA
  • Calendar VendorSamsung Affected before 12.3.05.10000 Fixed in 12.3.05.10000 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:*before 12.3.05.10000VulnerableSamsung
  • cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:* Versions before 12.3.05.10000 Vulnerable ·Samsung

Remediation

  • Fix · CNA Calendar (Samsung Mobile) Fixed in 12.3.05.10000

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-33705
  2. 2026-10-03 Alias added: GHSA-g29h-g6jc-79fj

References

Advisory 1

  • TI-2022-18909 Improper access control in Samsung Calendar CVSS 3.1MEDIUM 5.5
  • TI-2023-14492 Path traversal in Samsung Calendar CVSS 3.1MEDIUM 5.5
  • TI-2025-15031 Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and… CVSS 3.1MEDIUM 4.6
  • TI-2023-07865 Improper access control in Samsung Calendar prior to versions 12.4.02.9000 in Android 13… CVSS 3.1MEDIUM 4.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences