CVE-2018-9140

MEDIUM

Samsung Mobile M(6.0) - Cross-Site Scripting via Email Event Attribute

Title source: llm

Description

On Samsung mobile devices with M(6.0) software, the Email application allows XSS via an event attribute and arbitrary file loading via a src attribute, aka SVE-2017-10747.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://security.samsungmobile.com/securityUpdate.smsb

Scores

CVSS v3 6.1

EPSS 0.0036

EPSS Percentile 58.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

samsung/samsung_mobile 6.0

Published Mar 30, 2018

Tracked Since Feb 18, 2026