Details of VAR-202112-0232

ID

VAR-202112-0232

CVE

CVE-2021-37086

TITLE

Huawei Vulnerability related to improper retention of permissions in smartphone products

Trust: 0.8

sources: JVNDB: JVNDB-2021-016022

DESCRIPTION

There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers which can isolate and read synchronization files of other applications across the UID sandbox. Huawei A vulnerability related to improper retention of permissions exists in smartphone products.Information may be obtained. Huawei HarmonyOS is an operating system of the Chinese company Huawei. Provide a microkernel-based full-scenario distributed operating system. There is a security vulnerability in HUAWEI HarmonyOS

Trust: 1.71

sources: NVD: CVE-2021-37086 // JVNDB: JVNDB-2021-016022 // VULHUB: VHN-398921

AFFECTED PRODUCTS

vendor:	huawei	model:	harmonyos	scope:	lt	version:	2.0	Trust: 1.0
vendor:	huawei	model:	harmonyos	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	harmonyos	scope:	eq	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-016022 // NVD: CVE-2021-37086

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-37086
value:	HIGH
Trust: 1.0
NVD:	CVE-2021-37086
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202109-2041
value:	HIGH
Trust: 0.6
VULHUB:	VHN-398921
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-37086
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-398921
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-37086
baseSeverity:	HIGH
baseScore:	8.6
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	4.0
version:	3.1
Trust: 1.0
NVD:	CVE-2021-37086
baseSeverity:	HIGH
baseScore:	8.6
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-398921 // JVNDB: JVNDB-2021-016022 // CNNVD: CNNVD-202109-2041 // NVD: CVE-2021-37086

PROBLEMTYPE DATA

problemtype:	CWE-281	Trust: 1.1
problemtype:	Improper retention of permissions (CWE-281) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-398921 // JVNDB: JVNDB-2021-016022 // NVD: CVE-2021-37086

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202109-2041

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202109-2041

PATCH

title:	security-bulletins-202109-0000001196270727	url:	https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-0000001196270727	Trust: 0.8
title:	Huawei HarmonyOS Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=173798	Trust: 0.6

sources: JVNDB: JVNDB-2021-016022 // CNNVD: CNNVD-202109-2041

EXTERNAL IDS

db:	NVD	id:	CVE-2021-37086	Trust: 3.3
db:	JVNDB	id:	JVNDB-2021-016022	Trust: 0.8
db:	CNNVD	id:	CNNVD-202109-2041	Trust: 0.6
db:	CNVD	id:	CNVD-2021-103542	Trust: 0.1
db:	VULHUB	id:	VHN-398921	Trust: 0.1

sources: VULHUB: VHN-398921 // JVNDB: JVNDB-2021-016022 // CNNVD: CNNVD-202109-2041 // NVD: CVE-2021-37086

REFERENCES

url:	https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-0000001196270727	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2021-37086	Trust: 1.4
url:	https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202109-0000001196270727	Trust: 0.6

sources: VULHUB: VHN-398921 // JVNDB: JVNDB-2021-016022 // CNNVD: CNNVD-202109-2041 // NVD: CVE-2021-37086

SOURCES

db:	VULHUB	id:	VHN-398921
db:	JVNDB	id:	JVNDB-2021-016022
db:	CNNVD	id:	CNNVD-202109-2041
db:	NVD	id:	CVE-2021-37086

LAST UPDATE DATE

2024-08-14T13:43:08.718000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-398921	date:	2021-12-09T00:00:00
db:	JVNDB	id:	JVNDB-2021-016022	date:	2022-12-05T06:55:00
db:	CNNVD	id:	CNNVD-202109-2041	date:	2021-12-13T00:00:00
db:	NVD	id:	CVE-2021-37086	date:	2021-12-09T18:28:06.863

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-398921	date:	2021-12-07T00:00:00
db:	JVNDB	id:	JVNDB-2021-016022	date:	2022-12-05T00:00:00
db:	CNNVD	id:	CNNVD-202109-2041	date:	2021-09-05T00:00:00
db:	NVD	id:	CVE-2021-37086	date:	2021-12-07T17:15:09.567