cnvd - cnvd-2020-22206

cnvd-2020-22206

Vulnerability from cnvd

Title: Huawei Mate 30 Pro和Huawei Mate 30授权问题漏洞

Description:

Huawei Mate 30 Pro和Huawei Mate 30都是中国华为（Huawei）公司的一款智能手机。

Huawei Mate 30 Pro 10.0.0.205(C00E202R7P2)之前版本和Mate 30 10.0.0.205(C00E201R7P2)之前版本中存在授权问题漏洞，该漏洞在共享文件的特定场景下，系统中的一些功能接口未对该接口的调用者进行充分地身份认证。攻击者可利用该漏洞获取信息。

Severity: 中

Patch Name: Huawei Mate 30 Pro和Huawei Mate 30授权问题漏洞的补丁

Patch Description:

Huawei Mate 30 Pro和Huawei Mate 30都是中国华为（Huawei）公司的一款智能手机。

Huawei Mate 30 Pro 10.0.0.205(C00E202R7P2)之前版本和Mate 30 10.0.0.205(C00E201R7P2)之前版本中存在授权问题漏洞，该漏洞在共享文件的特定场景下，系统中的一些功能接口未对该接口的调用者进行充分地身份认证。攻击者可利用该漏洞获取信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20200408-01-smartphone-cn

Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-1801

Impacted products

Name
['Huawei Mate 30 Pro <10.0.0.205(C00E202R7P2)', 'Huawei Mate 30 <10.0.0.205(C00E201R7P2)']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-1801"
    }
  },
  "description": "Huawei Mate 30 Pro\u548cHuawei Mate 30\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u667a\u80fd\u624b\u673a\u3002\n\nHuawei Mate 30 Pro 10.0.0.205(C00E202R7P2)\u4e4b\u524d\u7248\u672c\u548cMate 30 10.0.0.205(C00E201R7P2)\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u5728\u5171\u4eab\u6587\u4ef6\u7684\u7279\u5b9a\u573a\u666f\u4e0b\uff0c\u7cfb\u7edf\u4e2d\u7684\u4e00\u4e9b\u529f\u80fd\u63a5\u53e3\u672a\u5bf9\u8be5\u63a5\u53e3\u7684\u8c03\u7528\u8005\u8fdb\u884c\u5145\u5206\u5730\u8eab\u4efd\u8ba4\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u4fe1\u606f\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20200408-01-smartphone-cn",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-22206",
  "openTime": "2020-04-09",
  "patchDescription": "Huawei Mate 30 Pro\u548cHuawei Mate 30\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u667a\u80fd\u624b\u673a\u3002\r\n\r\nHuawei Mate 30 Pro 10.0.0.205(C00E202R7P2)\u4e4b\u524d\u7248\u672c\u548cMate 30 10.0.0.205(C00E201R7P2)\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u5728\u5171\u4eab\u6587\u4ef6\u7684\u7279\u5b9a\u573a\u666f\u4e0b\uff0c\u7cfb\u7edf\u4e2d\u7684\u4e00\u4e9b\u529f\u80fd\u63a5\u53e3\u672a\u5bf9\u8be5\u63a5\u53e3\u7684\u8c03\u7528\u8005\u8fdb\u884c\u5145\u5206\u5730\u8eab\u4efd\u8ba4\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Huawei Mate 30 Pro\u548cHuawei Mate 30\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Huawei Mate 30 Pro \u003c10.0.0.205(C00E202R7P2)",
      "Huawei Mate 30 \u003c10.0.0.205(C00E201R7P2)"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-1801",
  "serverity": "\u4e2d",
  "submitTime": "2020-04-09",
  "title": "Huawei Mate 30 Pro\u548cHuawei Mate 30\u6388\u6743\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2020-1801 (GCVE-0-2020-1801)

Vulnerability from cvelistv5

Published

2020-04-10 14:04

Modified

2024-08-04 06:46

Severity ?

CWE

Improper Authentication

Summary

There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller's identity in certain share scenario, successful exploit could cause information disclosure. Affected product versions include:Mate 30 Pro versions Versions earlier than 10.0.0.205(C00E202R7P2);Mate 30 versions Versions earlier than 10.0.0.205(C00E201R7P2).

References

▼	URL	Tags
	https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200408-01-smartphone-en	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Mate 30 Pro;Mate 30	Version: Versions earlier than 10.0.0.205(C00E202R7P2) Version: Versions earlier than 10.0.0.205(C00E201R7P2)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:46:31.079Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200408-01-smartphone-en"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Mate 30 Pro;Mate 30",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Versions earlier than 10.0.0.205(C00E202R7P2)"
            },
            {
              "status": "affected",
              "version": "Versions earlier than 10.0.0.205(C00E201R7P2)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller\u0027s identity in certain share scenario, successful exploit could cause information disclosure. Affected product versions include:Mate 30 Pro versions Versions earlier than 10.0.0.205(C00E202R7P2);Mate 30 versions Versions earlier than 10.0.0.205(C00E201R7P2)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Authentication",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-10T14:04:19",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200408-01-smartphone-en"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@huawei.com",
          "ID": "CVE-2020-1801",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Mate 30 Pro;Mate 30",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Versions earlier than 10.0.0.205(C00E202R7P2)"
                          },
                          {
                            "version_value": "Versions earlier than 10.0.0.205(C00E201R7P2)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller\u0027s identity in certain share scenario, successful exploit could cause information disclosure. Affected product versions include:Mate 30 Pro versions Versions earlier than 10.0.0.205(C00E202R7P2);Mate 30 versions Versions earlier than 10.0.0.205(C00E201R7P2)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Authentication"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200408-01-smartphone-en",
              "refsource": "MISC",
              "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200408-01-smartphone-en"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2020-1801",
    "datePublished": "2020-04-10T14:04:19",
    "dateReserved": "2019-11-29T00:00:00",
    "dateUpdated": "2024-08-04T06:46:31.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted