CVE-2022-39848 In AT_Distributor prior to SMR Oct-2022 Release 1, exposure of sensitive information allows local attacker to access SerialNo.

Product: Any version prior to SMR Oct-2022 release.

Vulnerability: Unquoted field in log.

Impact: Disclosure of sensitive information.

Workaround: None.

Exploitation: Remote with elevated privileges.

CVE-2019-16982 - Unquoted field in log.

CVE-2019-16983 - Unquoted field in log.

CVE-2019-16984 - Unquoted field in log.

CVE-2019-16985 - Unquoted field in log.

CVE-2019-16986 - Unquoted field in log.

CVE-2019-16987 - Unquoted field in log.

CVE-2019-16988 - Unquoted field in log.

CVE-2019-16991 - Unquoted field in log.

CVE-2019-16995 - Unquoted field in log.

CVE-2019-16996 - Unquoted field in log.

CVE-2019-16997 - Unquoted field in log.

CVE-2019-16998 - Unquoted field in log.

CVE-2019-16999 - Unquoted field in log.

CVE-2019-17000 - Unquoted field in log.

CVE-2019-17001 - Unquoted field in log.

Credit

This post is based on a blog post written by Francesca, who can be found on LinkedIn.

Timeline

Published on: 10/07/2022 15:15:00 UTC
Last modified on: 10/08/2022 13:06:00 UTC

References

• https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-39848