PT-2016-6032 · Huawei · Huawei Plk+3

Publicado 2016-05-25 · Atualizado 2016-05-26 · CVE-2016-4575

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Huawei PLK smartphones versions AL10C00 through AL10C00B211 Huawei PLK smartphones versions AL10C92 through AL10C92B211 Huawei ATH smartphones versions AL00C00 through AL00C00B361 Huawei ATH smartphones versions CL00C92 through CL00C92B361 Huawei ATH smartphones versions TL00HC01 through TL00HC01B361 Huawei ATH smartphones versions UL00C00 through UL00C00B361 Huawei CherryPlus smartphones versions TL00C00 through TL00C00B553 Huawei CherryPlus smartphones versions UL00C00 through UL00C00B553 Huawei CherryPlus smartphones versions TL00MC01 through TL00MC01B553 Huawei RIO smartphones versions AL00C00 through AL00C00B360

Description A cross-site scripting (XSS) issue exists in the email application of certain Huawei smartphones, allowing remote attackers to inject arbitrary web script or HTML via an email message.

Recommendations For Huawei PLK smartphones versions AL10C00 through AL10C00B211, update to version AL10C00B211 or later. For Huawei PLK smartphones versions AL10C92 through AL10C92B211, update to version AL10C92B211 or later. For Huawei ATH smartphones versions AL00C00 through AL00C00B361, update to version AL00C00B361 or later. For Huawei ATH smartphones versions CL00C92 through CL00C92B361, update to version CL00C92B361 or later. For Huawei ATH smartphones versions TL00HC01 through TL00HC01B361, update to version TL00HC01B361 or later. For Huawei ATH smartphones versions UL00C00 through UL00C00B361, update to version UL00C00B361 or later. For Huawei CherryPlus smartphones versions TL00C00 through TL00C00B553, update to version TL00C00B553 or later. For Huawei CherryPlus smartphones versions UL00C00 through UL00C00B553, update to version UL00C00B553 or later. For Huawei CherryPlus smartphones versions TL00MC01 through TL00MC01B553, update to version TL00MC01B553 or later. For Huawei RIO smartphones versions AL00C00 through AL00C00B360, update to version AL00C00B360 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-4575

Produtos afetados

Huawei Ath

Huawei Cherryplus

Huawei Plk

Huawei Rio

Referências · 3

• http://huawei.com/en/psirt/security-advisories/huawei-sa-20160507-01-emailapp-en · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-4575 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-4575 · Nota de Segurança