PT-2022-26923 · Unknown · Openharmony

Published 2022-11-03 · Updated 2022-11-07 · CVE-2022-43449

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenHarmony versions 3.1.2 and prior

Description The issue allows local attackers to install a malicious application on the device and reveal any file from the filesystem that is accessible to the download server service, which runs with UID 1000. This is achieved through an arbitrary file read vulnerability via the download server.

Recommendations For OpenHarmony versions 3.1.2 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Files Accessible to External Parties

Weakness Enumeration

CWE-20

CWE-552

Related Identifiers

CVE-2022-43449

Affected Products

Openharmony

References · 5

• https://osv.dev/vulnerability/CVE-2022-43449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43449 · Security Note
• https://t.me/cibsecurity/52547 · Telegram Post
• https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.md · Patch, Vendor Advisory
• https://t.me/cvenotify/37143 · Telegram Post