PT-2017-13986 · Huawei · Huawei Ireader

Publicado 2017-12-22 · Atualizado 2018-08-02 · CVE-2017-15309

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Huawei iReader app versions prior to 8.0.2.301

Description The issue is related to a path traversal vulnerability due to insufficient validation on file storage paths. This allows an attacker to store downloaded malicious files in an arbitrary directory, potentially leading to privilege escalation. There are also reports of a directory traversal file deletion vulnerability.

Recommendations For versions prior to 8.0.2.301, update to version 8.0.2.301 or later to resolve the issue. As a temporary workaround, consider restricting access to file storage paths to minimize the risk of exploitation. Avoid using the onChapPack directory in the affected Huawei Reader app until the issue is resolved.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-15309

ZDI-18-874

ZDI-18-878

Produtos afetados

Huawei Ireader

Referências · 5

• http://huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171120-01-hwreader-en · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15309 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-18-878 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-18-874 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-15309 · Aviso do Fabricante