Lucene search

K
cve[email protected]CVE-2018-13895
HistoryMay 24, 2019 - 5:29 p.m.

CVE-2018-13895

2019-05-2417:29:01
CWE-284
web.nvd.nist.gov
37
cve-2018-13895
rcs app
manifest file
missing permissions
snapdragon
android
security
vulnerability

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

Due to the missing permissions on several content providers of the RCS app in its android manifest file will lead to an unprivileged access to phone in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20

Affected configurations

NVD
Node
qualcommmdm9150_firmwareMatch-
AND
qualcommmdm9150Match-
Node
qualcommmdm9206_firmwareMatch-
AND
qualcommmdm9206Match-
Node
qualcommmdm9607_firmwareMatch-
AND
qualcommmdm9607Match-
Node
qualcommmdm9650_firmwareMatch-
AND
qualcommmdm9650Match-
Node
qualcommmsm8909w_firmwareMatch-
AND
qualcommmsm8909wMatch-
Node
qualcommmsm8996au_firmwareMatch-
AND
qualcommmsm8996auMatch-
Node
qualcommqcs605_firmwareMatch-
AND
qualcommqcs605Match-
Node
qualcommqm215_firmwareMatch-
AND
qualcommqm215Match-
Node
qualcommsd_210_firmwareMatch-
AND
qualcommsd_210Match-
Node
qualcommsd_212_firmwareMatch-
AND
qualcommsd_212Match-
Node
qualcommsd_205_firmwareMatch-
AND
qualcommsd_205Match-
Node
qualcommsd_425_firmwareMatch-
AND
qualcommsd_425Match-
Node
qualcommsd_439_firmwareMatch-
AND
qualcommsd_439Match-
Node
qualcommsd_429_firmwareMatch-
AND
qualcommsd_429Match-
Node
qualcommsd_450_firmwareMatch-
AND
qualcommsd_450Match-
Node
qualcommsd_615_firmwareMatch-
AND
qualcommsd_615Match-
Node
qualcommsd_616_firmwareMatch-
AND
qualcommsd_616Match-
Node
qualcommsd_415_firmwareMatch-
AND
qualcommsd_415Match-
Node
qualcommsd_625_firmwareMatch-
AND
qualcommsd_625Match-
Node
qualcommsd_632_firmwareMatch-
AND
qualcommsd_632Match-
Node
qualcommsd_636_firmwareMatch-
AND
qualcommsd_636Match-
Node
qualcommsd_650_firmwareMatch-
AND
qualcommsd_650Match-
Node
qualcommsd_652_firmwareMatch-
AND
qualcommsd_652Match-
Node
qualcommsd_712_firmwareMatch-
AND
qualcommsd_712Match-
Node
qualcommsd_710_firmwareMatch-
AND
qualcommsd_710Match-
Node
qualcommsd_670_firmwareMatch-
AND
qualcommsd_670Match-
Node
qualcommsd_820_firmwareMatch-
AND
qualcommsd_820Match-
Node
qualcommsd_820a_firmwareMatch-
AND
qualcommsd_820aMatch-
Node
qualcommsd_835_firmwareMatch-
AND
qualcommsd_835Match-
Node
qualcommsd_845_firmwareMatch-
AND
qualcommsd_845Match-
Node
qualcommsd_850_firmwareMatch-
AND
qualcommsd_850Match-
Node
qualcommsd_855_firmwareMatch-
AND
qualcommsd_855Match-
Node
qualcommsda660_firmwareMatch-
AND
qualcommsda660Match-
Node
qualcommsdm439_firmwareMatch-
AND
qualcommsdm439Match-
Node
qualcommsdm630_firmwareMatch-
AND
qualcommsdm630Match-
Node
qualcommsdm660_firmwareMatch-
AND
qualcommsdm660Match-
Node
qualcommsdx20_firmwareMatch-
AND
qualcommsdx20Match-

CNA Affected

[
  {
    "product": "Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables",
    "vendor": "Qualcomm, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20"
      }
    ]
  }
]

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

Related for CVE-2018-13895