{"id":"CVE-2021-25373","state":"PUBLISHED","title":"Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in Android Q(10.0) and 2.9.01.1 in Android R(1","description":"Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in Android Q(10.0) and 2.9.01.1 in Android R(11.0) allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.","publishedAt":"2021-04-09T17:37:27.000Z","updatedAt":"2024-08-03T20:03:05.576Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"Samsung Mobile"},"assigner":"Samsung Mobile","products":["Samsung Mobile Customization Service"],"affected":[{"vendor":"Samsung Mobile","product":"Customization Service","versions":[{"version":"Android O(8.x)","status":"affected","lessThan":"2.2.02.1","versionType":"custom"},{"version":"Android P(9.0)","status":"affected","lessThan":"2.4.03.0","versionType":"custom"},{"version":"Android Q(10.0)","status":"affected","lessThan":"2.7.02.1","versionType":"custom"},{"version":"Android R(11.0)","status":"affected","lessThan":"2.9.01.1","versionType":"custom"}]}],"references":["https://security.samsungmobile.com/","https://security.samsungmobile.com/serviceWeb.smsb"],"weaknesses":["CWE-285"],"ingestedAt":"2026-10-29T19:48:10.461Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/25xxx/CVE-2021-25373.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-25373","state":"PUBLISHED","datePublished":"2021-04-09T17:37:27.000Z","dateUpdated":"2024-08-03T20:03:05.576Z","assignerShortName":"Samsung Mobile","assignerOrgId":"3af57064-a867-422c-b2ad-40307b65c458","dateReserved":"2021-01-19T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in Android Q(10.0) and 2.9.01.1 in Android R(11.0) allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent."}],"affected":[{"vendor":"Samsung Mobile","product":"Customization Service","versions":[{"version":"Android O(8.x)","status":"affected","lessThan":"2.2.02.1","versionType":"custom"},{"version":"Android P(9.0)","status":"affected","lessThan":"2.4.03.0","versionType":"custom"},{"version":"Android Q(10.0)","status":"affected","lessThan":"2.7.02.1","versionType":"custom"},{"version":"Android R(11.0)","status":"affected","lessThan":"2.9.01.1","versionType":"custom"}]}],"references":[{"url":"https://security.samsungmobile.com/","tags":["x_refsource_CONFIRM"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-285","description":"CWE-285 Improper Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Samsung Mobile","dateUpdated":"2021-04-09T17:37:27.000Z","orgId":"3af57064-a867-422c-b2ad-40307b65c458"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"mobile.security@samsung.com","ID":"CVE-2021-25373","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Customization Service","version":{"version_data":[{"version_affected":"<","version_name":"Android O(8.x)","version_value":"2.2.02.1"},{"version_affected":"<","version_name":"Android P(9.0)","version_value":"2.4.03.0"},{"version_affected":"<","version_name":"Android Q(10.0)","version_value":"2.7.02.1"},{"version_affected":"<","version_name":"Android R(11.0)","version_value":"2.9.01.1"}]}}]},"vendor_name":"Samsung Mobile"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in Android Q(10.0) and 2.9.01.1 in Android R(11.0) allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-285 Improper Authorization"}]}]},"references":{"reference_data":[{"name":"https://security.samsungmobile.com/","refsource":"CONFIRM","url":"https://security.samsungmobile.com/"},{"name":"https://security.samsungmobile.com/serviceWeb.smsb","refsource":"CONFIRM","url":"https://security.samsungmobile.com/serviceWeb.smsb"}]},"source":{"discovery":"UNKNOWN"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://security.samsungmobile.com/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T20:03:05.576Z"}}]}}}