Improper access control in Samsung MyFiles
Priority LOW 18CWE-284Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
Improper access control vulnerability in MyFiles application prior to versions 12.2.09.0 in Android 11, 13.1.03.501 in Android 12 and 14.1.03.0 in Android 13 allows local attacker to get sensitive information of secret mode in Samsung Internet application with specific conditions.
Why it matters now
EPSS 0.00149 4th percentileScored 2026-11-07
Fix Fixed MyFiles (Samsung Mobile): 12.2.09.0 in Android 11, 13.1.03.501 in Android12 and 14.1.03.0 in Android 13
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Samsung | MyFiles | before 12.2.09.0 in Android 11, 13.1.03.501 in Android12 and 14.1.03.0 in Android 13 | 12.2.09.0 in Android 11, 13.1.03.501 in Android12 and 14.1.03.0 in Android 13 | Patch available | CNA |
- MyFiles VendorSamsung Affected before 12.2.09.0 in Android 11, 13.1.03.501 in Android12 and 14.1.03.0 in Android 13 Fixed in 12.2.09.0 in Android 11, 13.1.03.501 in Android12 and 14.1.03.0 in Android 13 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:samsung:myfiles:*:*:*:*:*:*:*:* | before 12.2.09.0 | Vulnerable | Samsung |
| cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* | 11.0 | Running on | |
| cpe:2.3:a:samsung:myfiles:*:*:*:*:*:*:*:* | before 13.1.03.501 | Vulnerable | Samsung |
| cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* | 12.0 | Running on | |
| cpe:2.3:a:samsung:myfiles:*:*:*:*:*:*:*:* | before 14.1.03.0 | Vulnerable | Samsung |
| cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* | 13.0 | Running on |
- cpe:2.3:a:samsung:myfiles:*:*:*:*:*:*:*:* Versions before 12.2.09.0 Vulnerable ·Samsung
- cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* Versions 11.0 Running on ·Google
- cpe:2.3:a:samsung:myfiles:*:*:*:*:*:*:*:* Versions before 13.1.03.501 Vulnerable ·Samsung
- cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* Versions 12.0 Running on ·Google
- cpe:2.3:a:samsung:myfiles:*:*:*:*:*:*:*:* Versions before 14.1.03.0 Vulnerable ·Samsung
- cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* Versions 13.0 Running on ·Google
Remediation
- Fix · CNA MyFiles (Samsung Mobile) Fixed in 12.2.09.0 in Android 11, 13.1.03.501 in Android12 and 14.1.03.0 in Android 13
Timeline
- 2026-10-02 Threatist record created from CVE-2023-21463
- 2026-10-03 Alias added: GHSA-gf22-w2wm-v44w
References
More Samsung Myfiles vulnerabilities
- TI-2024-13598 Path traversal in Samsung Mobile Devices CVSS 3.1MEDIUM 5.5
- TI-2025-14922 Improper export of Android application components in My Files prior to version 15.0.07.5… CVSS 3.1MEDIUM 5.5
- TI-2024-13599 Path traversal in Samsung Mobile Devices CVSS 3.1MEDIUM 5.5
Sources
- CVE-2023-21463 · CVE Program
- CVE-2023-21463 · NVD
- FIRST EPSS
- GHSA-gf22-w2wm-v44w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences