CVE-2014-2388

2014-08-1811:15:25

CWE-264

[email protected]

web.nvd.nist.gov

cve-2014-2388

blackberry os

storage and access service

smb filesystem

password requirement

context-dependent attackers

arbitrary files

nvd

6.1 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:L/Au:N/C:C/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

61.2%

JSON

The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for SMB filesystem access, which allows context-dependent attackers to read arbitrary files via (1) a session over a Wi-Fi network or (2) a session over a USB connection in Development Mode.

Affected configurations

NVD

Node

blackberryblackberry_osRange≤10.1.0.2354

AND

blackberryq10Match-

blackberryq5Match-

blackberryz10Match-

blackberryz30Match-

CPENameOperatorVersion
blackberry:blackberry_osblackberry blackberry osle10.1.0.2354
blackberry:q10blackberry q10eq-
blackberry:q5blackberry q5eq-
blackberry:z10blackberry z10eq-
blackberry:z30blackberry z30eq-

CPE	Name	Operator	Version
blackberry:blackberry_os	blackberry blackberry os	le	10.1.0.2354
blackberry:q10	blackberry q10	eq	-
blackberry:q5	blackberry q5	eq	-
blackberry:z10	blackberry z10	eq	-
blackberry:z30	blackberry z30	eq	-