FKIE_CVE-2019-5252

Vulnerability from fkie_nvd - Published: 2019-12-14 00:15 - Updated: 2024-11-21 04:44
Severity ?
3.5 (Low) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
References
psirt@huawei.comhttps://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-smartphone-enVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-smartphone-enVendor Advisory
Impacted products
Vendor Product Version
huawei enjoy_8_plus_firmware *
huawei enjoy_8_plus -
huawei y9_firmware *
huawei y9 -
huawei honor_8x_firmware *
huawei honor_8x -
huawei honor_8x_firmware *
huawei honor_8x -
huawei honor_8x_firmware *
huawei honor_8x -
huawei honor_9_lite_firmware *
huawei honor_9_lite -
huawei honor_9_lite_firmware *
huawei honor_9_lite -
huawei honor_9i_firmware *
huawei honor_9i -
huawei honor_9i_firmware *
huawei honor_9i -
huawei y6_pro_firmware *
huawei y6_pro -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:enjoy_8_plus_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "17EDB3B1-7A08-4D8E-A8F0-5829B35D7A3B",
              "versionEndExcluding": "9.1.0.124\\(c00e112r1p6t8\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:enjoy_8_plus:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B1DC2A8F-FBFE-44BA-89C7-55B54B5AE086",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:y9_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A111265A-382A-4F19-BEB9-0EAB59F89F40",
              "versionEndExcluding": "9.1.0.131\\(c432e6r1p5t8\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:y9:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "92574DA9-4E40-48A7-AE10-72805CCAE4A9",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:honor_8x_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E5DB1A9-827C-495A-8A72-B8644BCABB57",
              "versionEndExcluding": "9.1.0.217\\(c00e15r3p2t8\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:honor_8x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7635502-0FD1-464E-8C64-1E8FF6235495",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:honor_8x_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7F5BCE2-46AF-4C24-98F0-504615A42B3E",
              "versionEndExcluding": "9.1.0.237\\(c432e1r3p2t8\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:honor_8x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7635502-0FD1-464E-8C64-1E8FF6235495",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:honor_8x_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "60DD085C-5447-44DE-ABDD-2A0C327BACC9",
              "versionEndExcluding": "9.1.0.237\\(c636e2r4p1t8\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:honor_8x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7635502-0FD1-464E-8C64-1E8FF6235495",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:honor_9_lite_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9DDE66A3-79DE-419C-B094-E1FD05AC6A68",
              "versionEndExcluding": "9.1.0.124\\(c00e112r2p10t8\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:honor_9_lite:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E571CDA8-577E-4165-A960-DAD978FD23BC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:honor_9_lite_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C92CA7BA-3A0F-4759-8129-0EF267BBA447",
              "versionEndExcluding": "9.1.0.136\\(c636e5r1p5t8\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:honor_9_lite:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E571CDA8-577E-4165-A960-DAD978FD23BC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:honor_9i_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2FD14B7B-772D-4935-96E1-C7418D8DDF02",
              "versionEndExcluding": "9.1.0.115\\(c00e113r1p6t8\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:honor_9i:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F931151C-4D0A-44D1-9417-B467F7E148A2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:honor_9i_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BECFDDE9-57E6-42E2-B545-AF5AC373B6C1",
              "versionEndExcluding": "9.1.0.122\\(c636e4r1p4t8\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:honor_9i:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F931151C-4D0A-44D1-9417-B467F7E148A2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:y6_pro_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "81E73A4B-72E9-4449-A76D-2A4300CFCC23",
              "versionEndExcluding": "9.1.0.248\\(c636e5r3p1\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:y6_pro:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6F54999-3926-438D-BF21-8417C6B7A175",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant."
    },
    {
      "lang": "es",
      "value": "Hay una vulnerabilidad de autenticaci\u00f3n inapropiada en los tel\u00e9fonos inteligentes Huawei (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). El componente applock no realiza una autenticaci\u00f3n suficiente en una condici\u00f3n extra\u00f1a. La explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante usar la aplicaci\u00f3n bloqueada por applock en un instante."
    }
  ],
  "id": "CVE-2019-5252",
  "lastModified": "2024-11-21T04:44:36.510",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 3.6,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-12-14T00:15:11.040",
  "references": [
    {
      "source": "psirt@huawei.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-smartphone-en"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-smartphone-en"
    }
  ],
  "sourceIdentifier": "psirt@huawei.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.