{"api_version":"1","generated_at":"2026-07-23T12:00:51+00:00","cve":"CVE-2021-25403","urls":{"html":"https://cve.report/CVE-2021-25403","api":"https://cve.report/api/cve/CVE-2021-25403.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-25403","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-25403"},"summary":{"title":"CVE-2021-25403","description":"Intent redirection vulnerability in Samsung Account prior to version 10.8.0.4 in Android P(9.0) and below, and 12.2.0.9 in Android Q(10.0) and above allows attacker to access contacts and file provider using SettingWebView component.","state":"PUBLIC","assigner":"mobile.security@samsung.com","published_at":"2021-06-11 15:15:00","updated_at":"2022-07-30 12:58:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5","name":"https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5","refsource":"MISC","tags":[],"title":"Samsung Mobile Security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-25403","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25403","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"25403","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"google","cpe5":"android","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"25403","vulnerable":"-1","versionEndIncluding":"9.0","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"google","cpe5":"android","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"25403","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"samsung","cpe5":"account","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"25403","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"samsung","cpe5":"account","cpe6":"12.2.0.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"mobile.security@samsung.com","ID":"CVE-2021-25403","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Samsung Account","version":{"version_data":[{"version_affected":"<","version_value":"10.8.0.4 in Android P(9.0) below, and 12.2.0.9 in Android Q(10.0) above"}]}}]},"vendor_name":"Samsung Mobile"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Intent redirection vulnerability in Samsung Account prior to version 10.8.0.4 in Android P(9.0) and below, and 12.2.0.9 in Android Q(10.0) and above allows attacker to access contacts and file provider using SettingWebView component."}]},"impact":{"cvss":{"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5","name":"https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5"}]},"source":{"discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2021-06-11 15:15:00","lastModifiedDate":"2022-07-30 12:58:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":2.1},"severity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:samsung:account:*:*:*:*:*:*:*:*","versionEndExcluding":"10.8.0.4","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:o:google:android:*:*:*:*:*:*:*:*","versionEndIncluding":"9.0","cpe_name":[]}]}],"cpe_match":[]},{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:samsung:account:12.2.0.9:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:o:google:android:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0","cpe_name":[]}]}],"cpe_match":[]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"25403","Ordinal":"200210","Title":"CVE-2021-25403","CVE":"CVE-2021-25403","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"25403","Ordinal":"1","NoteData":"Intent redirection vulnerability in Samsung Account prior to version 10.8.0.4 in Android P(9.0) and below, and 12.2.0.9 in Android Q(10.0) and above allows attacker to access contacts and file provider using SettingWebView component.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"25403","Ordinal":"2","NoteData":"2021-06-11","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"25403","Ordinal":"3","NoteData":"2021-06-11","Type":"Other","Title":"Modified"}]}}}