Lucene search

HuaweiCVE-2018-7957

HistoryJul 31, 2018 - 2:29 p.m.

CVE-2018-7957

2018-07-3114:29:01

CWE-863

huawei

web.nvd.nist.gov

huawei

smartphones

software

victoria-al00

vulnerability

information leakage

nvd

cve-2018-7957

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

Percentile

12.6%

JSON

Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability. Because an interface does not verify authorization correctly, attackers can exploit an application with the authorization of phone state to obtain user location additionally.

Affected configurations

Nvd

Vulners

Node

huaweivictoria-al00_firmwareMatchvictoria-al00_8.0.0.336a\(c00\)

AND

huaweivictoria-al00Match-

VendorProductVersionCPE
huaweivictoria-al00_firmwarevictoria-al00_8.0.0.336a(c00)cpe:2.3:o:huawei:victoria-al00_firmware:victoria-al00_8.0.0.336a\(c00\):*:*:*:*:*:*:*
huaweivictoria-al00-cpe:2.3:h:huawei:victoria-al00:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	victoria-al00_firmware	victoria-al00_8.0.0.336a(c00)	cpe:2.3:o:huawei:victoria-al00_firmware:victoria-al00_8.0.0.336a\(c00\):::::::*
huawei	victoria-al00	-	cpe:2.3:h:huawei:victoria-al00:-:::::::*

CNA Affected

[
  {
    "product": "Victoria-AL00",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Victoria-AL00 8.0.0.336a(C00)"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20180704-01-smartphone-en

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2018-7957