VulnerabilityModified

CVE-2022-43451

OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services.

MEDIUM 6.5EPSS 0.19%

Does this matter?

Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.

Description

OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary directories or escape application sandbox.If chained with other vulnerabilities it would allow an unprivileged process to gain full root privileges.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
EPSS: 0.19% probability · 9th percentile
CISA KEV: Not listed
Weakness: CWE-287, CWE-22
Affected: openharmony/openharmony
Source: scy@openharmony.io

References

https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.mdThird Party Advisory
https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.mdThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.