PT-2017-15486 · Huawei · Huawei Themes App

Published 2017-11-22 · Updated 2019-10-03 · CVE-2017-2699

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huawei Themes APP versions earlier than PLK-UL00C17B385 Huawei Themes APP versions earlier than CRR-L09C432B380 Huawei Themes APP versions earlier than LYO-L21C577B128

Description The issue allows an attacker to exploit a privilege elevation vulnerability to upload theme packs containing malicious files. This could trick users into installing the theme packets, resulting in the execution of arbitrary code.

Recommendations For versions earlier than PLK-UL00C17B385, update to a version PLK-UL00C17B385 or later. For versions earlier than CRR-L09C432B380, update to a version CRR-L09C432B380 or later. For versions earlier than LYO-L21C577B128, update to a version LYO-L21C577B128 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2017-2699

Affected Products

Huawei Themes App

References · 4

• https://osv.dev/vulnerability/CVE-2017-2699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2699 · Security Note
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20170222-01-theme-en · Vendor Advisory
• http://securityfocus.com/bid/96424 · Note