{"id":"CVE-2025-20897","state":"PUBLISHED","title":"Improper access control in Secure Folder prior to version 1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12 allows local attacker to access data in Secure","description":"Improper access control in Secure Folder prior to version 1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12 allows local attacker to access data in Secure Folder.","publishedAt":"2025-02-04T07:19:45.024Z","updatedAt":"2025-02-04T16:04:00.916Z","severity":{"score":6.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","source":"SamsungMobile"},"assigner":"SamsungMobile","products":["Samsung Mobile Secure Folder"],"affected":[{"vendor":"Samsung Mobile","product":"Secure Folder","defaultStatus":"affected","versions":[{"version":"1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12","status":"unaffected"}]}],"references":["https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=01"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/20xxx/CVE-2025-20897.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-20897","state":"PUBLISHED","datePublished":"2025-02-04T07:19:45.024Z","dateUpdated":"2025-02-04T16:04:00.916Z","assignerShortName":"SamsungMobile","assignerOrgId":"3af57064-a867-422c-b2ad-40307b65c458","dateReserved":"2024-11-06T02:30:14.838Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Improper access control in Secure Folder prior to version 1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12 allows local attacker to access data in Secure Folder."}],"affected":[{"vendor":"Samsung Mobile","product":"Secure Folder","defaultStatus":"affected","versions":[{"version":"1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12","status":"unaffected"}]}],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=01"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":6.8,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-926 : Improper Export of Android Application Components"}]}],"providerMetadata":{"shortName":"SamsungMobile","orgId":"3af57064-a867-422c-b2ad-40307b65c458","dateUpdated":"2025-02-04T07:19:45.024Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-04T16:03:18.359439Z","id":"CVE-2025-20897","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-04T16:04:00.916Z"}}]}}}