Read the docs
TI-2023-22728 Aliases CVE-2023-42578GHSA-m2rf-48j7-ch9q

Improper handling of exceptional conditions in Samsung Data Store

Priority LOW 34CWE-755Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Improper handling of insufficient permissions or privileges vulnerability in Samsung Data Store prior to version 5.2.00.7 allows remote attackers to access location information without permission.

Why it matters now

EPSS 0.00669 52nd percentileScored 2026-11-07
Fix Fixed Samsung Data Store (Samsung Mobile): 5.2.00.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungSamsung Data Store—5.2.00.7Patch availableCNA
  • Samsung Data Store VendorSamsung Affected — Fixed in 5.2.00.7 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:samsung:cloud:*:*:*:*:*:*:*:*up to 5.2.00.7VulnerableSamsung
  • cpe:2.3:a:samsung:cloud:*:*:*:*:*:*:*:* Versions up to 5.2.00.7 Vulnerable ·Samsung

Remediation

  • Fix · CNA Samsung Data Store (Samsung Mobile) Fixed in 5.2.00.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-42578
  2. 2026-10-03 Alias added: GHSA-m2rf-48j7-ch9q

References

Advisory 1

  • TI-2022-14831 Improper authorization in Samsung Cloud CVSS 3.1HIGH 7.5
  • TI-2021-07607 Improper authentication in Samsung Cloud CVSS 3.1HIGH 7.5
  • TI-2023-07849 Path traversal vulnerability in Samsung Cloud prior to version 5.3.0.32 allows attacker to access specific png file. CVSS 3.1MEDIUM 5.7
  • TI-2024-13645 Improper access control vulnerability in Samsung Data Store prior to version 5.3.00.4… CVSS 3.1MEDIUM 5.5
  • TI-2022-08737 Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR… CVSS 3.1MEDIUM 4.6
  • TI-2023-07848 Improper access control in Samsung Cloud CVSS 3.1MEDIUM 4.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences