CVE-2019-5299

{"id": "CVE-2019-5299", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-08-13T21:15:12.130", "references": [{"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190320-01-phone-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "Huawei mobile phones Hima-AL00Bhave with Versions earlier than HMA-AL00C00B175 have a signature verification bypass vulnerability. Attackers can induce users to install malicious applications. Due to a defect in the signature verification logic, the malicious applications can invoke specific interface to execute malicious code. A successful exploit may result in the execution of arbitrary code."}, {"lang": "es", "value": "Los tel\u00e9fonos m\u00f3viles Huawei Hima-AL00 en versiones anteriores a HMA-AL00C00B175 tienen una vulnerabilidad de omisi\u00f3n de verificaci\u00f3n de firma. Los atacantes pueden inducir a los usuarios a instalar aplicaciones maliciosas. Debido a un defecto en la l\u00f3gica de verificaci\u00f3n de firma, las aplicaciones maliciosas pueden invocar una interfaz espec\u00edfica para ejecutar c\u00f3digo malicioso. Una explotaci\u00f3n exitosa puede resultar en la ejecuci\u00f3n de c\u00f3digo arbitrario."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:hima-al00b_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FA8D7C7-DD2F-4244-8E83-F9A52C06E6F8", "versionEndExcluding": "hma-al00c00b175"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:hima-al00b:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8C0592A2-8087-4847-8586-04ED842960D4"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}