CVEvulnerability

CVE-2023-42579

5.3 MEDIUM Published 2023-12-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-12-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-319

Description

Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13 allows adjacent attackers to access keystroke data using Man-in-the-Middle attack.

Affected configurations

• samsung samsung keyboard (< 5.3.70.1) • samsung samsung keyboard (>= 5.4.60.0 < 5.4.60.49) • samsung samsung keyboard (>= 5.4.85.0 < 5.4.85.5) • samsung samsung keyboard (>= 5.5.00.0 < 5.5.00.58) • samsung samsung keyboard (>= 5.6.00.0 < 5.6.00.52) • samsung samsung keyboard (>= 5.6.10.0 < 5.6.10.42) • samsung samsung keyboard (>= 5.7.00.0 < 5.7.00.45)

Related

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References