CVE-2022-28784 - Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as system user

Back Back to CVE browser

MEDIUM

Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as system user

Published May 3, 2022

4.0

MEDIUM

CVSS 3.1

EPSS 0.12%

Description

Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as system user. The patch addresses incorrect implementation of file path validation check logic.

Affected products

Vendor Samsung Mobile Product Samsung Mobile Devices Default
n/a
- Version
  Q(10), R(11), S(12)
  Status
  affected
  Constraints
  <SMR May-2022 Release 1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Samsung Mobile

Samsung Mobile Devices

n/a

Version	Status	Constraints
Q(10), R(11), S(12)	affected	<SMR May-2022 Release 1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33223
Advisory
https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33223		Advisory
https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5		x_refsource_MISCVendor Advisory