CVE-2022-36871

MEDIUM

Samsung Pay < 5.1.47 (Global) < 5.0.63 (KR) - Unauthenticated Pending Intent Hijacking via Implicit Intent

Title source: llm

Description

Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09

Scores

CVSS v3 5.0

EPSS 0.0005

EPSS Percentile 17.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L

Details

CWE

CWE-285

Status published

Products (2)

samsung/samsung_pay < 5.1.47

samsung/samsung_pay_kr < 5.0.63

Published Sep 09, 2022

Tracked Since Feb 18, 2026