What is CVE-2018-10499?

CVE-2018-10499 is a high-severity vulnerability in Samsung Galaxy Apps, classified under Improper Input Validation. CVSS score: 7.0/10. Published 2018-09-24.

How severe is CVE-2018-10499?

High severity. CVSS v3 base score is 7.0 out of 10.

Improper input validation in Samsung Galaxy Apps

CVE-2018-10499

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy Apps Fixed in version 6.4.0.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of URLs. The issue lies in the lack of proper validation of user-supplied data, which can allow arbitrary JavaScript to execute. An attacker can leverage this vulnerability to install applications under the context of the current user. Was ZDI-CAN-5330.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.003 (24.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.0 (High). Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Samsung Galaxy_apps
Samsung Galaxy Apps — versions Fixed in version 6.4.0.15

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

zdi-disclosures@trendmicro.com (VDB Entry, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-10499?: CVE-2018-10499 is a high-severity vulnerability in Samsung Galaxy Apps, classified under Improper Input Validation. CVSS score: 7.0/10. Published 2018-09-24.
How severe is CVE-2018-10499?: High severity. CVSS v3 base score is 7.0 out of 10.