CVE-2023-30725 Auth bypass in Gallery

Medium 5.1 Published 6 Sep 2023 Updated 26 Sep 2024

An attacker can bypass authentication in the Samsung Gallery app to access private data stored in the content provider.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-30725?

CVE-2023-30725 is a medium-severity authentication bypass vulnerability in Samsung Mobile Gallery, published on 6 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Improper authentication in LocalProvier of Gallery prior to version 14.5.01.2 allows attacker to access the data in content provider.

Weakness: CWE-287

Which versions are affected by CVE-2023-30725?

It affects 1 product.

Products include Samsung Gallery.

How do I fix CVE-2023-30725?

No fix has been published for CVE-2023-30725 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-30725 being exploited?

There is no known exploitation of CVE-2023-30725 in the wild and no public exploit code.

Sources

Also known as GHSA-q9fw-58jw-47f2.