CWE Code: 200
Vulnerability Type: privilege_escalation
CVSS Score: 2.1
CWE Name:  Information Exposure
Summary: this vulnerability allows local attackers to disclose sensitive information on vulnerable installations of samsung email fixed in version 5.0.02.16. an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. the specific flaw exists within the handling of file:/// uris. the issue lies in the lack of proper validation of user-supplied data, which can allow for reading arbitrary files. an attacker can leverage this in conjunction with other vulnerabilities to escalate privileges. was zdi-can-5329.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2018-09-24
Last Modified Date: 2019-10-09