PT-2018-18350 · Huawei · Huawei Smartphone

Publicado 2018-07-31 · Atualizado 2019-10-03 · CVE-2018-7957

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Huawei smartphones with software Victoria-AL00 version 8.0.0.336a(C00)

Description: The issue is related to an information leakage problem. It occurs because an interface does not correctly verify authorization, allowing attackers to exploit an application that has phone state authorization to obtain additional user information, specifically the user's location.

Recommendations: For Huawei smartphones with software Victoria-AL00 version 8.0.0.336a(C00), consider restricting access to the phone state authorization until a fix is available. As a temporary workaround, review and limit applications with phone state access to minimize the risk of exploitation.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2018-7957

Produtos afetados

Huawei Smartphone

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-7957 · Nota de Segurança
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20180704-01-smartphone-en · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-7957 · Aviso do Fabricante