VULNERABILITY INTELLIGENCE

CVE-2019-6744

CVSS score4.3 MEDIUM

EPSS probability0.36%

CISA KEVNot currently listed

Published2020-02-10

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

This vulnerability allows local attackers to disclose sensitive information on affected installations of Samsung Knox 1.2.02.39 on Samsung Galaxy S9 build G9600ZHS3ARL1 Secure Folder. An attacker must first obtain physical access to the device in order to exploit this vulnerability. The specific flaws exists within the the handling of the lock screen for Secure Folder. The issue results from the lack of proper validation that a user has correctly authenticated. An attacker can leverage this vulnerability to disclose the contents of the secure container. Was ZDI-CAN-7381.

Weakness classification

CWE-284: Improper Access Control
CWE-287: Improper Authentication

Primary references

zdi-disclosures@trendmicro.com — Not Applicable
zdi-disclosures@trendmicro.com — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Not Applicable
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry