Security readout for executives and security teams
Plain-English summary
Samsung's MyFiles app had an access-control weakness that could let a local attacker use an implicit intent to make MyFiles write a file with its privileges. The public record rates it medium because exploitation requires local access and user interaction, but the CVSS impact flags high confidentiality risk.
Executive priority
Treat this as a moderate mobile fleet hygiene issue. It is not remotely exploitable based on the supplied evidence, but vulnerable devices may expose sensitive local files if a user is induced into the interaction path.
Technical view
CVE-2023-21445 is CWE-284 improper access control in Samsung MyFiles before 12.2.09 on Android 11, 13.1.03.501 on Android 12, and 14.1.00.422 on Android 13. Samsung says the patch adds proper access control to use explicit intent. CVSS 3.1 score is 5.5.
Likely exposure
Exposure is limited to Samsung Android devices running vulnerable MyFiles versions on Android 11, 12, or 13. The bundle does not identify other vendors or server-side exposure. Prioritize managed mobile fleets and BYOD devices where MyFiles versions are not centrally tracked.
Exploitation context
The CVSS vector is local, low complexity, no privileges required, and user interaction required. The source bundle does not report active exploitation, and the CVE is not listed as KEV. Public evidence here supports risk assessment, not claims of in-the-wild abuse.
Researcher notes
Key ambiguity: the description says file write with MyFiles privilege, while the CVSS vector records high confidentiality impact and no integrity impact. Do not broaden affected scope beyond Samsung MyFiles on Android 11, 12, and 13 without additional vendor evidence.
Mitigation direction
- Update Samsung MyFiles to the fixed version for the device Android release.
- Apply the relevant Samsung February 2023 mobile security update where available.
- Check Samsung vendor guidance for device-specific update paths and support status.
- Prioritize devices handling sensitive files or enterprise data.
Validation and detection
- Inventory Samsung Android 11, 12, and 13 devices in managed and BYOD scope.
- Confirm installed MyFiles versions meet or exceed the fixed version for each Android release.
- Verify mobile security patch level includes Samsung's February 2023 guidance where applicable.
- Review MDM compliance reports for unmanaged or unsupported Samsung devices.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-21445 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.