CVE-2023-44115 - OpenCVE

Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Huawei	Emui Harmonyos

Configuration 1 [-]

OR	cpe:2.3:o:huawei:harmonyos:2.0.0:::::::*
	cpe:2.3:o:huawei:harmonyos:2.0.1:::::::*
	cpe:2.3:o:huawei:harmonyos:2.1.0:::::::*
	cpe:2.3:o:huawei:harmonyos:3.0.0:::::::*
	cpe:2.3:o:huawei:harmonyos:3.1.0:::::::*
	cpe:2.3:o:huawei:harmonyos:4.0.0:::::::*

Configuration 2 [-]

OR	cpe:2.3:o:huawei:emui:12.0.0:::::::*
	cpe:2.3:o:huawei:emui:12.0.1:::::::*
	cpe:2.3:o:huawei:emui:13.0.0:::::::*

No data.

References

Link	Providers
https://consumer.huawei.com/en/support/bulletin/2023/11/
https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-0000001729189597

History

No history.

MITRE

Status: PUBLISHED

Assigner: huawei

Published: 2023-11-08T03:59:40.013Z

Updated: 2024-09-04T18:59:37.028Z

Reserved: 2023-09-25T09:11:04.626Z

Link: CVE-2023-44115

Vulnrichment

Updated: 2024-08-02T19:59:50.813Z

NVD

Status : Modified

Published: 2023-11-08T04:15:07.707

Modified: 2024-09-04T19:35:06.837

Link: CVE-2023-44115

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-44115", "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "state": "PUBLISHED", "assignerShortName": "huawei", "dateReserved": "2023-09-25T09:11:04.626Z", "datePublished": "2023-11-08T03:59:40.013Z", "dateUpdated": "2024-09-04T18:59:37.028Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "HarmonyOS", "vendor": "Huawei", "versions": [{"status": "affected", "version": "4.0.0"}, {"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "2.1.0"}, {"status": "affected", "version": "2.0.1"}, {"status": "affected", "version": "2.0.0"}]}, {"defaultStatus": "unaffected", "product": "EMUI", "vendor": "Huawei", "versions": [{"status": "affected", "version": "13.0.0"}, {"status": "affected", "version": "12.0.1"}, {"status": "affected", "version": "12.0.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality."}], "value": "Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei", "dateUpdated": "2023-11-08T03:59:40.013Z"}, "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2023/11/"}, {"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-0000001729189597"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:59:50.813Z"}, "title": "CVE Program Container", "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2023/11/", "tags": ["x_transferred"]}, {"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-0000001729189597", "tags": ["x_transferred"]}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-04T18:59:20.274116Z", "id": "CVE-2023-44115", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-04T18:59:37.028Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2023/11/", "tags": ["x_transferred"]}, {"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-0000001729189597", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:59:50.813Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-44115", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-04T18:59:20.274116Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-04T18:59:33.602Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Huawei", "product": "HarmonyOS", "versions": [{"status": "affected", "version": "4.0.0"}, {"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "2.1.0"}, {"status": "affected", "version": "2.0.1"}, {"status": "affected", "version": "2.0.0"}], "defaultStatus": "unaffected"}, {"vendor": "Huawei", "product": "EMUI", "versions": [{"status": "affected", "version": "13.0.0"}, {"status": "affected", "version": "12.0.1"}, {"status": "affected", "version": "12.0.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2023/11/"}, {"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-0000001729189597"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.", "supportingMedia": [{"type": "text/html", "value": "Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei", "dateUpdated": "2023-11-08T03:59:40.013Z"}}}, "cveMetadata": {"cveId": "CVE-2023-44115", "state": "PUBLISHED", "dateUpdated": "2024-09-04T18:59:37.028Z", "dateReserved": "2023-09-25T09:11:04.626Z", "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "datePublished": "2023-11-08T03:59:40.013Z", "assignerShortName": "huawei"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:harmonyos:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "20112231-B840-44D3-A061-B9B9F80EE378", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:harmonyos:2.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "64118936-E2A5-4935-8594-29DF29B5475A", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:harmonyos:2.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "C01447F1-7F58-4AE3-B403-C01B2575D898", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:harmonyos:3.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "CB3751C1-7729-41D3-AE50-80B5AF601135", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:harmonyos:3.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "4D81C4EF-7CAF-4E60-91A4-8CF7B95B2B54", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:harmonyos:4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "8198CDB2-4BC5-411A-8736-615A531FC545", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:emui:12.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "A974CA73-84E8-480B-BB4C-4A81D0C985B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:emui:12.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "2DF07E7F-3A18-4B74-B73D-DF3647C2A48F", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:emui:13.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "353AEAF2-AF46-4835-93E1-4F942D5E2810", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality."}, {"lang": "es", "value": "Vulnerabilidad de control de permisos inadecuado en el m\u00f3dulo Booster. Impacto: La explotaci\u00f3n exitosa de esta vulnerabilidad puede afectar la confidencialidad del servicio."}], "id": "CVE-2023-44115", "lastModified": "2024-09-04T19:35:06.837", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-11-08T04:15:07.707", "references": [{"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletin/2023/11/"}, {"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-0000001729189597"}], "sourceIdentifier": "psirt@huawei.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-200"}], "source": "psirt@huawei.com", "type": "Secondary"}]}