CVE-2018-7930

{"id": "CVE-2018-7930", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.9, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 5.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.1}]}, "published": "2018-04-11T17:29:00.427", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180411-01-smartphone-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The Near Field Communication (NFC) module in Mate 9 Huawei mobile phones with the versions before MHA-L29B 8.0.0.366(C567) has an information leak vulnerability due to insufficient validation on data transfer requests. When an affected mobile phone sends files to an attacker's mobile phone using the NFC function, the attacker can obtain arbitrary files from the mobile phone, causing information leaks."}, {"lang": "es", "value": "El m\u00f3dulo Near Field Communication (NFC) en los tel\u00e9fonos m\u00f3viles Mate 9 Huawei con versiones anteriores a MHA-L29B 8.0.0.366(C567) tiene una vulnerabilidad de fuga de informaci\u00f3n debido a una validaci\u00f3n insuficiente en las peticiones de transferencia de datos. Cuando un tel\u00e9fono m\u00f3vil afectado env\u00eda archivos al tel\u00e9fono m\u00f3vil del atacante mediante la funci\u00f3n NFC, el atacante puede obtener archivos arbitrarios desde el tel\u00e9fono m\u00f3vil, provocando fugas de informaci\u00f3n."}], "lastModified": "2018-05-24T15:18:17.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:mate_9_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0493CA9-F586-4767-BF54-0A0C55F51A58", "versionEndExcluding": "mha-l29b_8.0.0.366\\(c567\\)"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:mate_9:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "93FB7D8B-A819-4CBB-85D1-D3984D963351"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}