Details of VAR-202302-0317

ID

VAR-202302-0317

CVE

CVE-2022-48296

TITLE

EMUI and HarmonyOS Improper Permission Preservation Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-003614

DESCRIPTION

The SystemUI has a vulnerability in permission management. Successful exploitation of this vulnerability may cause users to receive broadcasts from malicious apps, conveying false alarm information about external storage devices. EMUI and HarmonyOS contains an improper permissions retention vulnerability.Information may be tampered with

Trust: 1.8

sources: NVD: CVE-2022-48296 // JVNDB: JVNDB-2023-003614 // VULHUB: VHN-453376 // VULMON: CVE-2022-48296

AFFECTED PRODUCTS

vendor:	huawei	model:	harmonyos	scope:	eq	version:	2.0	Trust: 1.0
vendor:	huawei	model:	harmonyos	scope:	eq	version:	3.0.0	Trust: 1.0
vendor:	huawei	model:	emui	scope:	eq	version:	12.0.0	Trust: 1.0
vendor:	huawei	model:	emui	scope:	eq	version:	12.0.1	Trust: 1.0
vendor:	huawei	model:	harmonyos	scope:	eq	version:	2.1	Trust: 1.0
vendor:	huawei	model:	emui	scope:	eq	version:	11.0.1	Trust: 1.0
vendor:	huawei	model:	emui	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	harmonyos	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2023-003614 // NVD: CVE-2022-48296

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-48296
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2022-48296
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202302-339
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2022-48296
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 1.0
NVD:	CVE-2022-48296
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2023-003614 // CNNVD: CNNVD-202302-339 // NVD: CVE-2022-48296

PROBLEMTYPE DATA

problemtype:	CWE-281	Trust: 1.1
problemtype:	Improper retention of permissions (CWE-281) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-453376 // JVNDB: JVNDB-2023-003614 // NVD: CVE-2022-48296

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202302-339

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202302-339

PATCH

title:	security-bulletins-202302-0000001454769474 Huawei Support Bulletin	url:	https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-0000001454769474	Trust: 0.8
title:	Huawei HarmonyOS Security vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=225927	Trust: 0.6

sources: JVNDB: JVNDB-2023-003614 // CNNVD: CNNVD-202302-339

EXTERNAL IDS

db:	NVD	id:	CVE-2022-48296	Trust: 3.4
db:	JVNDB	id:	JVNDB-2023-003614	Trust: 0.8
db:	CNNVD	id:	CNNVD-202302-339	Trust: 0.6
db:	VULHUB	id:	VHN-453376	Trust: 0.1
db:	VULMON	id:	CVE-2022-48296	Trust: 0.1

sources: VULHUB: VHN-453376 // VULMON: CVE-2022-48296 // JVNDB: JVNDB-2023-003614 // CNNVD: CNNVD-202302-339 // NVD: CVE-2022-48296

REFERENCES

url:	https://consumer.huawei.com/en/support/bulletin/2023/2/	Trust: 1.8
url:	https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-0000001454769474	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-48296	Trust: 0.8
url:	https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202302-0000001454769474	Trust: 0.6
url:	https://cxsecurity.com/cveshow/cve-2022-48296/	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-453376 // VULMON: CVE-2022-48296 // JVNDB: JVNDB-2023-003614 // CNNVD: CNNVD-202302-339 // NVD: CVE-2022-48296

SOURCES

db:	VULHUB	id:	VHN-453376
db:	VULMON	id:	CVE-2022-48296
db:	JVNDB	id:	JVNDB-2023-003614
db:	CNNVD	id:	CNNVD-202302-339
db:	NVD	id:	CVE-2022-48296

LAST UPDATE DATE

2024-08-14T13:21:07.617000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-453376	date:	2023-02-17T00:00:00
db:	VULMON	id:	CVE-2022-48296	date:	2023-02-09T00:00:00
db:	JVNDB	id:	JVNDB-2023-003614	date:	2023-09-14T07:27:00
db:	CNNVD	id:	CNNVD-202302-339	date:	2023-02-20T00:00:00
db:	NVD	id:	CVE-2022-48296	date:	2023-02-17T13:20:07.597

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-453376	date:	2023-02-09T00:00:00
db:	VULMON	id:	CVE-2022-48296	date:	2023-02-09T00:00:00
db:	JVNDB	id:	JVNDB-2023-003614	date:	2023-09-14T00:00:00
db:	CNNVD	id:	CNNVD-202302-339	date:	2023-02-05T00:00:00
db:	NVD	id:	CVE-2022-48296	date:	2023-02-09T17:15:14.337