Lucene search

HuaweiCVE-2017-8177

HistoryNov 22, 2017 - 7:29 p.m.

CVE-2017-8177

2017-11-2219:29:04

CWE-347

huawei

web.nvd.nist.gov

huawei

hiwallet

cve-2017-8177

apk

hijacking

vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

40.6%

JSON

Huawei APP HiWallet earlier than 5.0.3.100 versions do not support signature verification for APK file. An attacker could exploit this vulnerability to hijack the APK and upload modified APK file. Successful exploit could lead to the APP is hijacking.

Affected configurations

Nvd

Vulners

Node

huaweihiwalletRange<5.0.3.100

VendorProductVersionCPE
huaweihiwallet*cpe:2.3:a:huawei:hiwallet:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	hiwallet	*	cpe:2.3:a:huawei:hiwallet::::::::

CNA Affected

[
  {
    "product": "HiWallet",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Earlier than 5.0.3.100 versions"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20170816-01-app-en

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

40.6%

JSON

Related for CVE-2017-8177