by Kastro
Paper/Archive/CVE-2023-39403

CVE-2023-39403

Huawei HarmonyOS — Parameter verification vulnerability in the installd module.

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
34
CVSS 9.1 (ADP, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 31.7.317 × 206.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.

Affected

ProductAffectedFixed inSource
HarmonyOS3.1.0–CNA
HarmonyOS3.0.0–CNA
HarmonyOS2.1.0–CNA
HarmonyOS2.0.0–CNA
HarmonyOS2.0.1–CNA
EMUI13.0.0–CNA
EMUI12.0.1–CNA
EMUI12.0.0–CNA
EMUI11.0.1–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refconsumer.huawei.com/en/support/bulletin/2023/8refdevice.harmonyos.com/en/docs/security/update/security-bulletins-202308-0000001667644725