« Volver al listado

CVE-2024-34637

Estado: AnalizadaMedia (5.5)—

El control de acceso inadecuado en WindowManagerService antes de SMR Sep-2024 Release 1 en Android 12, y SMR Jun-2024 Release 1 en Android 13 y Android 14 permite a atacantes locales eludir las restricciones al inicio de servicios desde segundo plano.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Samsung — Android

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-34637",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-34637",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-04T13:10:00.655657Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "mobile.security@samsung.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.2,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "mobile.security@samsung.com",
      "affectedData": [
        {
          "vendor": "Samsung Mobile",
          "product": "Samsung Mobile Devices",
          "versions": [
            {
              "status": "unaffected",
              "version": "SMR Sep-2024 Release in SMR Sep-2024 Release 1 in Android 12 and SMR Jun-2024 Release 1 in Android 13, 14"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-09-04T06:15:11.377",
  "references": [
    {
      "url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=09",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "mobile.security@samsung.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release 1 in Android 13 and Android 14 allows local attackers to bypass restrictions on starting services from the background."
    },
    {
      "lang": "es",
      "value": "El control de acceso inadecuado en WindowManagerService antes de SMR Sep-2024 Release 1 en Android 12, y SMR Jun-2024 Release 1 en Android 13 y Android 14 permite a atacantes locales eludir las restricciones al inicio de servicios desde segundo plano."
    }
  ],
  "lastModified": "2026-06-17T07:33:46.763",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:samsung:android:12.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D757450C-270E-4FB2-A50C-7F769FED558A"
            },
            {
              "criteria": "cpe:2.3:o:samsung:android:12.0:smr_sep-2024-r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE6DDF76-7C22-4AE7-A84E-431807413952"
            },
            {
              "criteria": "cpe:2.3:o:samsung:android:13.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A123EDB1-3048-44B0-8D4D-39A2B24B5F6B"
            },
            {
              "criteria": "cpe:2.3:o:samsung:android:13.0:smr-jun-2024-r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E346DCBD-7DEB-464F-B917-8624BE87D646"
            },
            {
              "criteria": "cpe:2.3:o:samsung:android:14.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3093F6FE-C562-4F62-97B7-CA0D2DDF9BBE"
            },
            {
              "criteria": "cpe:2.3:o:samsung:android:14.0:smr-jun-2024-r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D66CF415-6C4A-4AF3-B660-B2E9CF484B51"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "mobile.security@samsung.com"
}