cnvd - cnvd-2020-46469

CNVD-2020-46469

Vulnerability from cnvd - Published: 2020-08-17

Title

Huawei Mate 20不当授权漏洞

Description

Huawei Mate 20是华为推出的一款智能手机。 Huawei Mate 20 10.1.0.160(C00E160R2P11)之前版本存在安全漏洞。该漏洞源于软件在某些情况下不能适当限制某些操作。攻击者可利用该漏洞绕过学生模式功能的限制。

Severity

低

Patch Name

Huawei Mate 20不当授权漏洞的补丁

Patch Description

Huawei Mate 20是华为推出的一款智能手机。 Huawei Mate 20 10.1.0.160(C00E160R2P11)之前版本存在安全漏洞。该漏洞源于软件在某些情况下不能适当限制某些操作。攻击者可利用该漏洞绕过学生模式功能的限制。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200722-02-smartphone-en

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-9251

Impacted products

Name
Huawei Mate 20 <10.1.0.160(C00E160R2P11)

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-9251",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-9251"
    }
  },
  "description": "Huawei Mate 20\u662f\u534e\u4e3a\u63a8\u51fa\u7684\u4e00\u6b3e\u667a\u80fd\u624b\u673a\u3002\n\nHuawei Mate 20 10.1.0.160(C00E160R2P11)\u4e4b\u524d\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8f6f\u4ef6\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\u4e0d\u80fd\u9002\u5f53\u9650\u5236\u67d0\u4e9b\u64cd\u4f5c\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b66\u751f\u6a21\u5f0f\u529f\u80fd\u7684\u9650\u5236\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200722-02-smartphone-en",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-46469",
  "openTime": "2020-08-17",
  "patchDescription": "Huawei Mate 20\u662f\u534e\u4e3a\u63a8\u51fa\u7684\u4e00\u6b3e\u667a\u80fd\u624b\u673a\u3002\r\n\r\nHuawei Mate 20 10.1.0.160(C00E160R2P11)\u4e4b\u524d\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8f6f\u4ef6\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\u4e0d\u80fd\u9002\u5f53\u9650\u5236\u67d0\u4e9b\u64cd\u4f5c\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b66\u751f\u6a21\u5f0f\u529f\u80fd\u7684\u9650\u5236\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Huawei Mate 20\u4e0d\u5f53\u6388\u6743\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Huawei Mate 20 \u003c10.1.0.160(C00E160R2P11)"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-9251",
  "serverity": "\u4f4e",
  "submitTime": "2020-07-28",
  "title": "Huawei Mate 20\u4e0d\u5f53\u6388\u6743\u6f0f\u6d1e"
}

CVE-2020-9251 (GCVE-0-2020-9251)

Vulnerability from cvelistv5 – Published: 2020-07-27 12:08 – Updated: 2024-08-04 10:19

Summary

HUAWEI Mate 20 smartphones with versions earlier than 10.1.0.160(C00E160R2P11) have an improper authorization vulnerability. The software does not properly restrict certain operation in certain scenario, the attacker should do certain configuration before the user turns on student mode function. Successful exploit could allow the attacker to bypass the limit of student mode function. Affected product versions include: HUAWEI Mate 20 versions Versions earlier than 10.1.0.160(C00E160R3P8).

Severity ?

No CVSS data available.

CWE

Improper Authorization

Assigner

huawei

References

URL

Tags

https://www.huawei.com/en/psirt/security-advisori…

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	HUAWEI Mate 20	Affected: Versions earlier than 10.1.0.160(C00E160R2P11)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:19:20.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200722-02-smartphone-en"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "HUAWEI Mate 20",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Versions earlier than 10.1.0.160(C00E160R2P11)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HUAWEI Mate 20 smartphones with versions earlier than 10.1.0.160(C00E160R2P11) have an improper authorization vulnerability. The software does not properly restrict certain operation in certain scenario, the attacker should do certain configuration before the user turns on student mode function. Successful exploit could allow the attacker to bypass the limit of student mode function. Affected product versions include: HUAWEI Mate 20 versions Versions earlier than 10.1.0.160(C00E160R3P8)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Authorization",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-27T12:08:19",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200722-02-smartphone-en"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@huawei.com",
          "ID": "CVE-2020-9251",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "HUAWEI Mate 20",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Versions earlier than 10.1.0.160(C00E160R2P11)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "HUAWEI Mate 20 smartphones with versions earlier than 10.1.0.160(C00E160R2P11) have an improper authorization vulnerability. The software does not properly restrict certain operation in certain scenario, the attacker should do certain configuration before the user turns on student mode function. Successful exploit could allow the attacker to bypass the limit of student mode function. Affected product versions include: HUAWEI Mate 20 versions Versions earlier than 10.1.0.160(C00E160R3P8)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200722-02-smartphone-en",
              "refsource": "MISC",
              "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200722-02-smartphone-en"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2020-9251",
    "datePublished": "2020-07-27T12:08:19",
    "dateReserved": "2020-02-18T00:00:00",
    "dateUpdated": "2024-08-04T10:19:20.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-46469

CVE-2020-9251 (GCVE-0-2020-9251)

Tags

Sightings

Nomenclature