Vulnerability-Lookup

CNVD-2020-22206

Vulnerability from cnvd - Published: 2020-04-09

Title

Huawei Mate 30 Pro和Huawei Mate 30授权问题漏洞

Description

Huawei Mate 30 Pro和Huawei Mate 30都是中国华为（Huawei）公司的一款智能手机。 Huawei Mate 30 Pro 10.0.0.205(C00E202R7P2)之前版本和Mate 30 10.0.0.205(C00E201R7P2)之前版本中存在授权问题漏洞，该漏洞在共享文件的特定场景下，系统中的一些功能接口未对该接口的调用者进行充分地身份认证。攻击者可利用该漏洞获取信息。

Severity

中

Patch Name

Huawei Mate 30 Pro和Huawei Mate 30授权问题漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20200408-01-smartphone-cn

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-1801

Impacted products

Name
['Huawei Mate 30 Pro <10.0.0.205(C00E202R7P2)', 'Huawei Mate 30 <10.0.0.205(C00E201R7P2)']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-1801"
    }
  },
  "description": "Huawei Mate 30 Pro\u548cHuawei Mate 30\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u667a\u80fd\u624b\u673a\u3002\n\nHuawei Mate 30 Pro 10.0.0.205(C00E202R7P2)\u4e4b\u524d\u7248\u672c\u548cMate 30 10.0.0.205(C00E201R7P2)\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u5728\u5171\u4eab\u6587\u4ef6\u7684\u7279\u5b9a\u573a\u666f\u4e0b\uff0c\u7cfb\u7edf\u4e2d\u7684\u4e00\u4e9b\u529f\u80fd\u63a5\u53e3\u672a\u5bf9\u8be5\u63a5\u53e3\u7684\u8c03\u7528\u8005\u8fdb\u884c\u5145\u5206\u5730\u8eab\u4efd\u8ba4\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u4fe1\u606f\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20200408-01-smartphone-cn",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-22206",
  "openTime": "2020-04-09",
  "patchDescription": "Huawei Mate 30 Pro\u548cHuawei Mate 30\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u667a\u80fd\u624b\u673a\u3002\r\n\r\nHuawei Mate 30 Pro 10.0.0.205(C00E202R7P2)\u4e4b\u524d\u7248\u672c\u548cMate 30 10.0.0.205(C00E201R7P2)\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u5728\u5171\u4eab\u6587\u4ef6\u7684\u7279\u5b9a\u573a\u666f\u4e0b\uff0c\u7cfb\u7edf\u4e2d\u7684\u4e00\u4e9b\u529f\u80fd\u63a5\u53e3\u672a\u5bf9\u8be5\u63a5\u53e3\u7684\u8c03\u7528\u8005\u8fdb\u884c\u5145\u5206\u5730\u8eab\u4efd\u8ba4\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Huawei Mate 30 Pro\u548cHuawei Mate 30\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Huawei Mate 30 Pro \u003c10.0.0.205(C00E202R7P2)",
      "Huawei Mate 30 \u003c10.0.0.205(C00E201R7P2)"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-1801",
  "serverity": "\u4e2d",
  "submitTime": "2020-04-09",
  "title": "Huawei Mate 30 Pro\u548cHuawei Mate 30\u6388\u6743\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2020-1801 (GCVE-0-2020-1801)

Vulnerability from cvelistv5 – Published: 2020-04-10 14:04 – Updated: 2024-08-04 06:46

Summary

There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller's identity in certain share scenario, successful exploit could cause information disclosure. Affected product versions include:Mate 30 Pro versions Versions earlier than 10.0.0.205(C00E202R7P2);Mate 30 versions Versions earlier than 10.0.0.205(C00E201R7P2).

Severity

No CVSS data available.

CWE

Improper Authentication

Assigner

huawei mitre root

References

1 reference

URL	Tags
https://www.huawei.com/en/psirt/security-advisori…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Mate 30 Pro;Mate 30	Affected: Versions earlier than 10.0.0.205(C00E202R7P2) Affected: Versions earlier than 10.0.0.205(C00E201R7P2)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:46:31.079Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200408-01-smartphone-en"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Mate 30 Pro;Mate 30",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Versions earlier than 10.0.0.205(C00E202R7P2)"
            },
            {
              "status": "affected",
              "version": "Versions earlier than 10.0.0.205(C00E201R7P2)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller\u0027s identity in certain share scenario, successful exploit could cause information disclosure. Affected product versions include:Mate 30 Pro versions Versions earlier than 10.0.0.205(C00E202R7P2);Mate 30 versions Versions earlier than 10.0.0.205(C00E201R7P2)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Authentication",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-10T14:04:19.000Z",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200408-01-smartphone-en"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@huawei.com",
          "ID": "CVE-2020-1801",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Mate 30 Pro;Mate 30",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Versions earlier than 10.0.0.205(C00E202R7P2)"
                          },
                          {
                            "version_value": "Versions earlier than 10.0.0.205(C00E201R7P2)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller\u0027s identity in certain share scenario, successful exploit could cause information disclosure. Affected product versions include:Mate 30 Pro versions Versions earlier than 10.0.0.205(C00E202R7P2);Mate 30 versions Versions earlier than 10.0.0.205(C00E201R7P2)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Authentication"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200408-01-smartphone-en",
              "refsource": "MISC",
              "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200408-01-smartphone-en"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2020-1801",
    "datePublished": "2020-04-10T14:04:19.000Z",
    "dateReserved": "2019-11-29T00:00:00.000Z",
    "dateUpdated": "2024-08-04T06:46:31.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2020-22206

CVE-2020-1801 (GCVE-0-2020-1801)

Tags

Sightings

Nomenclature

Related by attack behaviour