CVE-2023-21491: High severity samsung android vulnerability

Published May 4, 2023

Updated

Improper access control vulnerability in ThemeManager prior to SMR May-2023 Release 1 allows local attackers to write arbitrary files with system privilege.

Affected Software

24 affected components

Samsung android=12.0

Samsung android=12.0-smr-apr-2022-r1

Samsung android=12.0-smr-aug-2022-r1

Samsung android=12.0-smr-dec-2021-r1

Samsung android=12.0-smr-dec-2022-r1

Samsung android=12.0-smr-feb-2022-r1

Samsung android=12.0-smr-feb-2023-r1

Samsung android=12.0-smr-jan-2022-r1

Samsung android=12.0-smr-jul-2022-r1

Samsung android=12.0-smr-jun-2022-r1

Samsung android=12.0-smr-mar-2022-r1

Samsung android=12.0-smr-may-2022-r1

Samsung android=12.0-smr-nov-2021-r1

Samsung android=12.0-smr-nov-2022-r1

Samsung android=12.0-smr-oct-2022-r1

Samsung android=12.0-smr-sep-2022-r1

Samsung android=13.0

Samsung android=13.0-smr-apr-2023-r1

Samsung android=13.0-smr-dec-2022-r1

Samsung android=13.0-smr-feb-2023-r1

Samsung android=13.0-smr-jan-2023-r1

Samsung android=13.0-smr-mar-2023-r1

Samsung android=13.0-smr-nov-2022-r1

Samsung android=13.0-smr-oct-2022-r1

Event History

May 4, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Data Sourced

09:15 PM

Description

Frequently Asked Questions

What is the vulnerability ID of this vulnerability?

The vulnerability ID is CVE-2023-21491.

What is the severity of CVE-2023-21491?

The severity of CVE-2023-21491 is rated as high with a CVSS score of 7.8.

How does CVE-2023-21491 impact Samsung Android devices running version 12.0?

CVE-2023-21491 allows local attackers to write arbitrary files with system privilege on Samsung Android devices running version 12.0.

How can I fix the vulnerability CVE-2023-21491?

To fix the vulnerability CVE-2023-21491, you should install the SMR May-2023 Release 1 for Samsung Android devices running version 12.0. Please refer to the official Samsung security update page for more information: [Samsung Security Updates](https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=05)

What is the Common Weakness Enumeration (CWE) ID associated with CVE-2023-21491?

The Common Weakness Enumeration (CWE) ID associated with CVE-2023-21491 is CWE-284.