Read the docs
TI-2022-18909 Aliases CVE-2022-39915GHSA-c888-5r7v-37mw

Improper access control in Samsung Calendar

Priority LOW 25CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), and 12.4.02.0 in Android T(13) allows attackers to access sensitive information via implicit intent.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00301 23rd percentileScored 2026-11-07
Fix Fixed Samsung Calendar (Samsung Mobile): 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12) +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungSamsung Calendarbefore 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), and 12.4.02.0 in Android T(13)11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), and 12.4.02.0 in Android T(13)Patch availableCNA
  • Samsung Calendar VendorSamsung Affected before 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), and 12.4.02.0 in Android T(13) Fixed in 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), and 12.4.02.0 in Android T(13) Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:*before 11.6.08.0VulnerableSamsung
cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*10.0Running onGoogle
cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:*before 12.2.11.3000VulnerableSamsung
cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*11.0Running onGoogle
cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:*before 12.3.07.2000VulnerableSamsung
cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*12.0Running onGoogle
cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:*before 12.4.02.0VulnerableSamsung
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*13.0Running onGoogle
  • cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:* Versions before 11.6.08.0 Vulnerable ·Samsung
  • cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:* Versions 10.0 Running on ·Google
  • cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:* Versions before 12.2.11.3000 Vulnerable ·Samsung
  • cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* Versions 11.0 Running on ·Google
  • cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:* Versions before 12.3.07.2000 Vulnerable ·Samsung
  • cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* Versions 12.0 Running on ·Google
  • cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:* Versions before 12.4.02.0 Vulnerable ·Samsung
  • cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* Versions 13.0 Running on ·Google

Remediation

  • Fix · CNA Samsung Calendar (Samsung Mobile) Fixed in 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), and 12.4.02.0 in Android T(13)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39915
  2. 2026-10-03 Alias added: GHSA-c888-5r7v-37mw

References

Advisory 1

  • TI-2023-14492 Path traversal in Samsung Calendar CVSS 3.1MEDIUM 5.5
  • TI-2025-15031 Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and… CVSS 3.1MEDIUM 4.6
  • TI-2023-07865 Improper access control in Samsung Calendar prior to versions 12.4.02.9000 in Android 13… CVSS 3.1MEDIUM 4.0
  • TI-2022-14823 Improper authorization in Samsung Calendar CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences