PT-2022-26924 · Unknown · Openharmony

Published 2022-11-03 · Updated 2022-11-07 · CVE-2022-43451

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenHarmony versions prior to 3.1.2

Description The issue is related to a multiple path traversal vulnerability in the appspawn and nwebspawn services. This vulnerability allows local attackers to create arbitrary directories or escape the application sandbox. If combined with other vulnerabilities, it could enable an unprivileged process to gain full root privileges.

Recommendations For OpenHarmony versions prior to 3.1.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Path traversal

Weakness Enumeration

CWE-287

CWE-22

Related Identifiers

CVE-2022-43451

Affected Products

Openharmony

References · 5

• https://osv.dev/vulnerability/CVE-2022-43451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43451 · Security Note
• https://t.me/cibsecurity/52548 · Telegram Post
• https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.md · Patch, Vendor Advisory
• https://t.me/cvenotify/37142 · Telegram Post