CVE-2020-1788

Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability. Certain applications do not properly validate the identity of another application who would call its interface. An attacker could trick the user into installing a malicious application. Successful exploit could allow unauthorized actions leading to information disclosure.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-02-smartphone-en	Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-02-smartphone-en	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:huawei:honor_v30_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:huawei:honor_v30:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-01-21 23:15

Updated : 2024-11-21 05:11

NVD link : CVE-2020-1788

Mitre link : CVE-2020-1788

CVE.ORG link : CVE-2020-1788

JSON object : View

Products Affected

huawei

honor_v30_firmware
honor_v30

CWE

CWE-287

Improper Authentication

{"id": "CVE-2020-1788", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2020-01-21T23:15:13.647", "references": [{"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-02-smartphone-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}, {"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-02-smartphone-en", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability. Certain applications do not properly validate the identity of another application who would call its interface. An attacker could trick the user into installing a malicious application. Successful exploit could allow unauthorized actions leading to information disclosure."}, {"lang": "es", "value": "Los tel\u00e9fonos inteligentes Honor V30 con versiones anteriores a 10.0.1.135(C00E130R4P1), presentan una vulnerabilidad de autenticaci\u00f3n inapropiada. Ciertas aplicaciones no comprueban apropiadamente la identidad de otra aplicaci\u00f3n que llamar\u00eda a su interfaz. Un atacante podr\u00eda enga\u00f1ar al usuario para que instale una aplicaci\u00f3n maliciosa. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir acciones no autorizadas que conllevan a una divulgaci\u00f3n de informaci\u00f3n."}], "lastModified": "2024-11-21T05:11:22.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:honor_v30_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC7FFDFA-2349-40EA-8DBD-F308CE72F005", "versionEndExcluding": "10.0.1.135\\(c00e130r4p1\\)"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:honor_v30:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A90E11A8-FDDC-4F27-BA4F-52E158FAD83C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}