CVE-2024-49414 - Vulnerability Details - OpenCVE

ReportizFlow

Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list.

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Samsung	Android

No data.

No data.

References

Link	Providers
https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12

History

Tue, 03 Dec 2024 12:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Samsung Samsung android
CPEs		cpe:2.3:o:samsung:android:12.0:smr-dec-2024-r1:::::: cpe:2.3:o:samsung:android:13.0:smr-dec-2024-r1:::::: cpe:2.3:o:samsung:android:14.0:smr-dec-2024-r1::::::
Vendors & Products		Samsung Samsung android
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 03 Dec 2024 06:00:00 +0000

Type	Values Removed	Values Added
Description		Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list.
References		https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
Metrics		cvssV3_1 `{'score': 2.4, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: SamsungMobile

Published: 2024-12-03T05:47:57.426Z

Updated: 2024-12-03T11:28:54.837Z

Reserved: 2024-10-15T05:26:08.660Z

Link: CVE-2024-49414

Vulnrichment

Updated: 2024-12-03T11:28:40.421Z

NVD

Status : Received

Published: 2024-12-03T06:15:09.430

Modified: 2024-12-03T06:15:09.430

Link: CVE-2024-49414

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-49414", "assignerOrgId": "3af57064-a867-422c-b2ad-40307b65c458", "state": "PUBLISHED", "assignerShortName": "SamsungMobile", "dateReserved": "2024-10-15T05:26:08.660Z", "datePublished": "2024-12-03T05:47:57.426Z", "dateUpdated": "2024-12-03T11:28:54.837Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-288: Authentication Bypass Using an Alternate Path"}]}], "affected": [{"vendor": "Samsung Mobile", "product": "Samsung Mobile Devices", "versions": [{"status": "unaffected", "version": "SMR Dec-2024 Release in Android 12, 13, 14"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list."}], "references": [{"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 2.4, "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "providerMetadata": {"orgId": "3af57064-a867-422c-b2ad-40307b65c458", "shortName": "SamsungMobile", "dateUpdated": "2024-12-03T05:47:57.426Z"}}, "adp": [{"affected": [{"vendor": "samsung", "product": "android", "cpes": ["cpe:2.3:o:samsung:android:13.0:smr-dec-2024-r1:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "13.0", "status": "unaffected"}]}, {"vendor": "samsung", "product": "android", "cpes": ["cpe:2.3:o:samsung:android:14.0:smr-dec-2024-r1:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "14.0", "status": "unaffected"}]}, {"vendor": "samsung", "product": "android", "cpes": ["cpe:2.3:o:samsung:android:12.0:smr-dec-2024-r1:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "12.0", "status": "unaffected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-03T11:28:44.360417Z", "id": "CVE-2024-49414", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-03T11:28:54.837Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-49414", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-03T11:28:44.360417Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:samsung:android:13.0:smr-dec-2024-r1:*:*:*:*:*:*"], "vendor": "samsung", "product": "android", "versions": [{"status": "unaffected", "version": "13.0"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:samsung:android:14.0:smr-dec-2024-r1:*:*:*:*:*:*"], "vendor": "samsung", "product": "android", "versions": [{"status": "unaffected", "version": "14.0"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:samsung:android:12.0:smr-dec-2024-r1:*:*:*:*:*:*"], "vendor": "samsung", "product": "android", "versions": [{"status": "unaffected", "version": "12.0"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-03T11:28:40.421Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Samsung Mobile", "product": "Samsung Mobile Devices", "versions": [{"status": "unaffected", "version": "SMR Dec-2024 Release in Android 12, 13, 14"}], "defaultStatus": "affected"}], "references": [{"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12"}], "descriptions": [{"lang": "en", "value": "Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-288: Authentication Bypass Using an Alternate Path"}]}], "providerMetadata": {"orgId": "3af57064-a867-422c-b2ad-40307b65c458", "shortName": "SamsungMobile", "dateUpdated": "2024-12-03T05:47:57.426Z"}}}, "cveMetadata": {"cveId": "CVE-2024-49414", "state": "PUBLISHED", "dateUpdated": "2024-12-03T11:28:54.837Z", "dateReserved": "2024-10-15T05:26:08.660Z", "assignerOrgId": "3af57064-a867-422c-b2ad-40307b65c458", "datePublished": "2024-12-03T05:47:57.426Z", "assignerShortName": "SamsungMobile"}, "dataVersion": "5.1"}