CVE-2022-39915 Information disclosure in Samsung Calendar
Attackers can access sensitive information in Samsung Calendar via implicit intents, requiring users to update the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-39915?
CVE-2022-39915 is a low-severity vulnerability in Samsung Calendar, published on 8 Dec 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), and 12.4.02.0 in Android T(13) allows attackers to access sensitive information via implicit intent.
Weakness: CWE-284
Which versions are affected by CVE-2022-39915?
It affects 1 product.
Products include Samsung Calendar.
How do I fix CVE-2022-39915?
No fix has been published for CVE-2022-39915 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-39915 being exploited?
There is no known exploitation of CVE-2022-39915 in the wild and no public exploit code.
Other vulnerabilities in Samsung Calendar
Sources
Also known as GHSA-c888-5r7v-37mw.