CVE-2018-7922

{"id": "CVE-2018-7922", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2018-09-12T15:29:00.983", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180911-01-smartphone-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Huawei ALP-L09 smart phones with versions earlier than ALP-L09 8.0.0.150(C432) have an insufficient input validation vulnerability due to lack of parameter check. An attacker tricks the user who has root privilege to install a crafted application, the application may modify the specific data to exploit the vulnerability. Successful exploit could allow the attacker to execute arbitrary code."}, {"lang": "es", "value": "Los smartphones Huawei ALP-L09 en versiones anteriores a la ALP-L09 8.0.0.150(C432) tienen una vulnerabilidad de validaci\u00f3n de entradas insuficiente debido a la falta de comprobaci\u00f3n de par\u00e1metros. Un atacante enga\u00f1a al usuario que tiene privilegios root para que instale una aplicaci\u00f3n manipulada, que podr\u00eda modificar los datos espec\u00edficos para explotar la vulnerabilidad. Su explotaci\u00f3n con \u00e9xito podr\u00eda permitir que el atacante ejecute c\u00f3digo arbitrario."}], "lastModified": "2018-11-20T18:09:04.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:alp-l09_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22A24B54-EA96-417D-812B-6D4DCF1976E3", "versionEndExcluding": "8.0.0.150\\(c432\\)"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:alp-l09:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "34ACFA43-7B18-437C-91F8-07F7B265657B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}