Lucene search

HuaweiCVE-2017-2723

HistoryNov 22, 2017 - 7:29 p.m.

CVE-2017-2723

2017-11-2219:29:01

CWE-312

huawei

web.nvd.nist.gov

cve-2017-2723

huawei

mobile phone

plaintext storage

vulnerability

android

information leak

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.2

Confidence

High

EPSS

Percentile

12.6%

JSON

The Files APP 7.1.1.308 and earlier versions in some Huawei mobile phones has a vulnerability of plaintext storage of users’ Safe passwords. An attacker with the root privilege of an Android system could forge the Safe to read users’ plaintext Safe passwords, leading to information leak.

Affected configurations

Nvd

Vulners

Node

huaweifilesRange≤7.1.1.308

VendorProductVersionCPE
huaweifiles*cpe:2.3:a:huawei:files:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	files	*	cpe:2.3:a:huawei:files::::::::

CNA Affected

[
  {
    "product": "Files",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "7.1.1.308 and earlier versions"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20170419-01-files-en

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.2

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2017-2723