Vulnerability · Published Nov 3, 2022 · Assigned by OpenHarmony
CVE-2022-43451Multiple path traversal in appspawn and nwebspawn services.
High 8.4
In plain English
A high-severity improper authentication in OpenHarmony from OpenHarmony. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.2%top 90.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary directories or escape application sandbox.If chained with other vulnerabilities it would allow an unprivileged process to gain full root privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenHarmony | OpenHarmony | 3.1.0 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.md patch, vendor-advisory