CVE-2023-42579 - Vulnerability Details

Vendors	Products
Google	Android
Samsung	Samsung Keyboard

Link	Providers
https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-42579", "assignerOrgId": "3af57064-a867-422c-b2ad-40307b65c458", "state": "PUBLISHED", "assignerShortName": "SamsungMobile", "dateReserved": "2023-09-11T23:55:08.357Z", "datePublished": "2023-12-05T02:44:36.992Z", "dateUpdated": "2024-08-02T19:23:40.156Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-319: Cleartext Transmission of Sensitive Information"}]}], "affected": [{"vendor": "Samsung Mobile", "product": "Samsung Keyboard", "versions": [{"status": "unaffected", "version": "5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13 allows adjacent attackers to access keystroke data using Man-in-the-Middle attack."}], "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "providerMetadata": {"orgId": "3af57064-a867-422c-b2ad-40307b65c458", "shortName": "SamsungMobile", "dateUpdated": "2023-12-05T02:44:36.992Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:23:40.156Z"}, "title": "CVE Program Container", "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-42579 (string)

assignerOrgId : 3af57064-a867-422c-b2ad-40307b65c458 (string)

state : PUBLISHED (string)

assignerShortName : SamsungMobile (string)

dateReserved : 2023-09-11T23:55:08.357Z (string)

datePublished : 2023-12-05T02:44:36.992Z (string)

dateUpdated : 2024-08-02T19:23:40.156Z (string)

}

containers : { »

cna : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

description : CWE-319: Cleartext Transmission of Sensitive Information (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Samsung Mobile (string)

product : Samsung Keyboard (string)

versions : [ »

0 : { »

status : unaffected (string)

version : 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13 (string)

}

]

defaultStatus : affected (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13 allows adjacent attackers to access keystroke data using Man-in-the-Middle attack. (string)

}

]

references : [ »

0 : { »

url : https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12 (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

version : 3.1 (string)

attackVector : ADJACENT_NETWORK (string)

attackComplexity : LOW (string)

privilegesRequired : NONE (string)

userInteraction : NONE (string)

scope : UNCHANGED (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

availabilityImpact : NONE (string)

baseSeverity : MEDIUM (string)

baseScore : 6.5 (number)

vectorString : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

}

]

providerMetadata : { »

orgId : 3af57064-a867-422c-b2ad-40307b65c458 (string)

shortName : SamsungMobile (string)

dateUpdated : 2023-12-05T02:44:36.992Z (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T19:23:40.156Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF1C9578-2FA5-45E7-84C4-7D00AB0B13C4", "versionEndExcluding": "5.3.70.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:*", "matchCriteriaId": "590537E6-3C33-4A36-B2DA-D15DD9577EDE", "versionEndExcluding": "5.4.60.49", "versionStartIncluding": "5.4.60.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BAA17C0-045C-4864-BF1E-05234B8CC3EE", "versionEndExcluding": "5.4.85.5", "versionStartIncluding": "5.4.85.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:*", "matchCriteriaId": "54AE42D4-0B71-4E83-89E9-CD42D7FA381C", "versionEndExcluding": "5.5.00.58", "versionStartIncluding": "5.5.00.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "109DD7FD-3A48-4C3D-8E1A-4433B98E1E64", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF1C9578-2FA5-45E7-84C4-7D00AB0B13C4", "versionEndExcluding": "5.3.70.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:*", "matchCriteriaId": "B5096E6D-1D66-4C9E-BE44-0FBB9F594FBB", "versionEndExcluding": "5.6.00.52", "versionStartIncluding": "5.6.00.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:*", "matchCriteriaId": "6202106E-97BB-4735-828D-28AA1C443408", "versionEndExcluding": "5.6.10.42", "versionStartIncluding": "5.6.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E637BBE-BF99-4464-9C17-F3D1AAF44FA5", "versionEndExcluding": "5.7.00.45", "versionStartIncluding": "5.7.00.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "F8FB8EE9-FC56-4D5E-AE55-A5967634740C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF1C9578-2FA5-45E7-84C4-7D00AB0B13C4", "versionEndExcluding": "5.3.70.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*", "matchCriteriaId": "879FFD0C-9B38-4CAA-B057-1086D794D469", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13 allows adjacent attackers to access keystroke data using Man-in-the-Middle attack."}, {"lang": "es", "value": "Uso inadecuado de un protocolo inseguro (es decir, HTTP) en SogouSDK of Chinese Samsung Keyboard anterior a las versiones 5.3.70.1 en Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 en Android 12 y 5.6.00.52, 5.6.10.42, 5.7 .00.45 en Android 13 permite a atacantes adyacentes acceder a datos de pulsaciones de teclas mediante el ataque Man-in-the-Middle."}], "id": "CVE-2023-42579", "lastModified": "2024-11-21T08:22:49.837", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "mobile.security@samsung.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-05T03:15:18.967", "references": [{"source": "mobile.security@samsung.com", "tags": ["Vendor Advisory"], "url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12"}], "sourceIdentifier": "mobile.security@samsung.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:* (string)

matchCriteriaId : BF1C9578-2FA5-45E7-84C4-7D00AB0B13C4 (string)

versionEndExcluding : 5.3.70.1 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 590537E6-3C33-4A36-B2DA-D15DD9577EDE (string)

versionEndExcluding : 5.4.60.49 (string)

versionStartIncluding : 5.4.60.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 6BAA17C0-045C-4864-BF1E-05234B8CC3EE (string)

versionEndExcluding : 5.4.85.5 (string)

versionStartIncluding : 5.4.85.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 54AE42D4-0B71-4E83-89E9-CD42D7FA381C (string)

versionEndExcluding : 5.5.00.58 (string)

versionStartIncluding : 5.5.00.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 109DD7FD-3A48-4C3D-8E1A-4433B98E1E64 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:* (string)

matchCriteriaId : BF1C9578-2FA5-45E7-84C4-7D00AB0B13C4 (string)

versionEndExcluding : 5.3.70.1 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:* (string)

matchCriteriaId : B5096E6D-1D66-4C9E-BE44-0FBB9F594FBB (string)

versionEndExcluding : 5.6.00.52 (string)

versionStartIncluding : 5.6.00.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 6202106E-97BB-4735-828D-28AA1C443408 (string)

versionEndExcluding : 5.6.10.42 (string)

versionStartIncluding : 5.6.10.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1E637BBE-BF99-4464-9C17-F3D1AAF44FA5 (string)

versionEndExcluding : 5.7.00.45 (string)

versionStartIncluding : 5.7.00.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* (string)

matchCriteriaId : F8FB8EE9-FC56-4D5E-AE55-A5967634740C (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

2 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:samsung:samsung_keyboard:*:*:*:*:*:*:*:* (string)

matchCriteriaId : BF1C9578-2FA5-45E7-84C4-7D00AB0B13C4 (string)

versionEndExcluding : 5.3.70.1 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 879FFD0C-9B38-4CAA-B057-1086D794D469 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13 allows adjacent attackers to access keystroke data using Man-in-the-Middle attack. (string)

}

1 : { »

lang : es (string)

value : Uso inadecuado de un protocolo inseguro (es decir, HTTP) en SogouSDK of Chinese Samsung Keyboard anterior a las versiones 5.3.70.1 en Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 en Android 12 y 5.6.00.52, 5.6.10.42, 5.7 .00.45 en Android 13 permite a atacantes adyacentes acceder a datos de pulsaciones de teclas mediante el ataque Man-in-the-Middle. (string)

}

]

id : CVE-2023-42579 (string)

lastModified : 2024-11-21T08:22:49.837 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : ADJACENT_NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : mobile.security@samsung.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : ADJACENT_NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.6 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-12-05T03:15:18.967 (string)

references : [ »

0 : { »

source : mobile.security@samsung.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12 (string)

}

]

sourceIdentifier : mobile.security@samsung.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-319 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Affected Vendors & Products

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object