Read the docs
TI-2022-17084 Aliases CVE-2022-36869GHSA-v6g2-g5rp-j92j

Improper access control in Samsung com.android.providers.contacts

Priority LOW 28CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Improper access control vulnerability in ContactsDumpActivity of?Contacts Provider prior to version 12.7.59 allows attacker to access the file without permission.

Why it matters now

EPSS 0.00181 7th percentileScored 2026-11-07
Fix Fixed com.android.providers.contacts (Samsung Mobile): 12.7.59

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Samsungcom.android.providers.contactsbefore 12.7.5912.7.59Patch availableCNA
  • com.android.providers.contacts VendorSamsung Affected before 12.7.59 Fixed in 12.7.59 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:samsung:contacts_provider:*:*:*:*:*:android:*:*before 12.7.59VulnerableSamsung
  • cpe:2.3:a:samsung:contacts_provider:*:*:*:*:*:android:*:* Versions before 12.7.59 Vulnerable ·Samsung

Remediation

  • Fix · CNA com.android.providers.contacts (Samsung Mobile) Fixed in 12.7.59

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36869
  2. 2026-10-03 Alias added: GHSA-v6g2-g5rp-j92j

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences