CVE-2022-24923

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Feb 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-249245.3An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system directory without a pr CVE-2022-249256.5Improper input validation vulnerability in SettingsProvider prior to Android S(12) allows privileged attackers to trigger a permanent denial CVE-2022-249265.4Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.15-6 allows privileged attackers to trigger a XSS on a victim CVE-2022-249279.8Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to execute video files witho CVE-2022-249287.8Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP.CVE-2022-249293.3Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication.CVE-2022-24938.1Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.CVE-2022-249303.3An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted a CVE-2022-249317.8Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthorized attackers to exe CVE-2022-249324.6Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package CVE-2022-249349.8wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.CVE-2022-249357.5Lexmark products through 2022-02-10 have Incorrect Access Control.