7.1high
CVE-2017-8153
Huawei VMall (for Android) with the versions before 1.5.8.5 have a privilege elevation vulnerability due to improper design.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 49%
Public exploits
0
none known
Summary
Huawei VMall (for Android) with the versions before 1.5.8.5 have a privilege elevation vulnerability due to improper design. An attacker can trick users into installing a malicious app which can send out HTTP requests and execute JavaScript code in web pages without obtaining the Internet access permission. Successful exploit could lead to resource occupation or information leak.
Exploit prediction (EPSS)
0.61% probability of exploitation in the next 30 days, higher than 49% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.1 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:N/A:P |
Affected products
- Huawei Technologies Co., Ltd. VMall (for Android)
Classification
- Weakness
- CWE-275 Permission Issues
References
- huawei.com /en/psirt/security-advisories/huawei-sa-20170901-01-smartphone-en · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-8153
- NVD: CVE-2017-8153
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.