PT-2017-15486 · Huawei · Huawei Themes App

Publicado 2017-11-22 · Atualizado 2019-10-03 · CVE-2017-2699

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huawei Themes APP versions earlier than PLK-UL00C17B385 Huawei Themes APP versions earlier than CRR-L09C432B380 Huawei Themes APP versions earlier than LYO-L21C577B128

Description The issue allows an attacker to exploit a privilege elevation vulnerability to upload theme packs containing malicious files. This could trick users into installing the theme packets, resulting in the execution of arbitrary code.

Recommendations For versions earlier than PLK-UL00C17B385, update to a version PLK-UL00C17B385 or later. For versions earlier than CRR-L09C432B380, update to a version CRR-L09C432B380 or later. For versions earlier than LYO-L21C577B128, update to a version LYO-L21C577B128 or later.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2017-2699

Produtos afetados

Huawei Themes App

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-2699 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2699 · Nota de Segurança
• http://securityfocus.com/bid/96424 · Nota
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20170222-01-theme-en · Aviso do Fabricante