#VU85080 Path traversal in Samsung Mobile Firmware - CVE-2024-20804

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU85080

#VU85080 Path traversal in Samsung Mobile Firmware - CVE-2024-20804

Published: January 8, 2024


Vulnerability identifier: #VU85080
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2024-20804
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Samsung Mobile Firmware
Software vendor:
Samsung

Description

The vulnerability allows a remote attacker to overwrite arbitrary files on the system.

The vulnerability exists due to input validation error when processing directory traversal sequences in FileUriConverter of MyFiles. A remote attacker can trick the victim to open a specially crafted archive and overwrite arbitrary files on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.


Remediation

Install update from vendor's website.

External links