CVE-2024-49411 - Vulnerability Details - OpenCVE

ReportizFlow

Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege.

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Samsung	Android

No data.

No data.

References

Link	Providers
https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12

History

Tue, 03 Dec 2024 12:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Samsung Samsung android
CPEs		cpe:2.3:o:samsung:android:12.0:smr-dec-2024-r1:::::: cpe:2.3:o:samsung:android:13.0:smr-dec-2024-r1:::::: cpe:2.3:o:samsung:android:14.0:smr-dec-2024-r1::::::
Vendors & Products		Samsung Samsung android
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 03 Dec 2024 06:00:00 +0000

Type	Values Removed	Values Added
Description		Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege.
References		https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: SamsungMobile

Published: 2024-12-03T05:47:53.600Z

Updated: 2024-12-03T11:31:00.965Z

Reserved: 2024-10-15T05:26:08.659Z

Link: CVE-2024-49411

Vulnrichment

Updated: 2024-12-03T11:30:42.549Z

NVD

Status : Received

Published: 2024-12-03T06:15:09.033

Modified: 2024-12-03T06:15:09.033

Link: CVE-2024-49411

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-49411", "assignerOrgId": "3af57064-a867-422c-b2ad-40307b65c458", "state": "PUBLISHED", "assignerShortName": "SamsungMobile", "dateReserved": "2024-10-15T05:26:08.659Z", "datePublished": "2024-12-03T05:47:53.600Z", "dateUpdated": "2024-12-03T11:31:00.965Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "affected": [{"vendor": "Samsung Mobile", "product": "Samsung Mobile Devices", "versions": [{"status": "unaffected", "version": "SMR Dec-2024 Release in Android 12, 13, 14"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege."}], "references": [{"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}}], "providerMetadata": {"orgId": "3af57064-a867-422c-b2ad-40307b65c458", "shortName": "SamsungMobile", "dateUpdated": "2024-12-03T05:47:53.600Z"}}, "adp": [{"affected": [{"vendor": "samsung", "product": "android", "cpes": ["cpe:2.3:o:samsung:android:12.0:smr-dec-2024-r1:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "12.0", "status": "unaffected"}]}, {"vendor": "samsung", "product": "android", "cpes": ["cpe:2.3:o:samsung:android:13.0:smr-dec-2024-r1:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "13.0", "status": "unaffected"}]}, {"vendor": "samsung", "product": "android", "cpes": ["cpe:2.3:o:samsung:android:14.0:smr-dec-2024-r1:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "14.0", "status": "unaffected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-03T11:30:52.345023Z", "id": "CVE-2024-49411", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-03T11:31:00.965Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-49411", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-03T11:30:52.345023Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:samsung:android:12.0:smr-dec-2024-r1:*:*:*:*:*:*"], "vendor": "samsung", "product": "android", "versions": [{"status": "unaffected", "version": "12.0"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:samsung:android:13.0:smr-dec-2024-r1:*:*:*:*:*:*"], "vendor": "samsung", "product": "android", "versions": [{"status": "unaffected", "version": "13.0"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:samsung:android:14.0:smr-dec-2024-r1:*:*:*:*:*:*"], "vendor": "samsung", "product": "android", "versions": [{"status": "unaffected", "version": "14.0"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-03T11:30:42.549Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Samsung Mobile", "product": "Samsung Mobile Devices", "versions": [{"status": "unaffected", "version": "SMR Dec-2024 Release in Android 12, 13, 14"}], "defaultStatus": "affected"}], "references": [{"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12"}], "descriptions": [{"lang": "en", "value": "Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "3af57064-a867-422c-b2ad-40307b65c458", "shortName": "SamsungMobile", "dateUpdated": "2024-12-03T05:47:53.600Z"}}}, "cveMetadata": {"cveId": "CVE-2024-49411", "state": "PUBLISHED", "dateUpdated": "2024-12-03T11:31:00.965Z", "dateReserved": "2024-10-15T05:26:08.659Z", "assignerOrgId": "3af57064-a867-422c-b2ad-40307b65c458", "datePublished": "2024-12-03T05:47:53.600Z", "assignerShortName": "SamsungMobile"}, "dataVersion": "5.1"}