There is a path traversal vulnerability in some Huawei products. The vulnerability is due to that the software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly validate the pathname. Successful exploit could allow the attacker to access a location that is outside of the restricted directory by a crafted filename. Affected product versions include:HUAWEI Mate 20 9.0.0.195(C01E195R2P1), 9.1.0.139(C00E133R3P1);HUAWEI Mate 20 Pro 9.0.0.187(C432E10R1P16), 9.0.0.188(C185E10R2P1), 9.0.0.245(C10E10R2P1), 9.0.0.266(C432E10R1P16), 9.0.0.267(C636E10R2P1), 9.0.0.268(C635E12R1P16), 9.0.0.278(C185E10R2P1); Hima-L29C 9.0.0.105(C10E9R1P16), 9.0.0.105(C185E9R1P16), 9.0.0.105(C636E9R1P16); Laya-AL00EP 9.1.0.139(C786E133R3P1); OxfordS-AN00A 10.1.0.223(C00E210R5P1); Tony-AL00B 9.1.0.257(C00E222R2P1).
References
| Link | Resource |
|---|---|
| https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210630-01-pathtraversal-en | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
History
15 Jul 2021, 22:28
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 | |
| CVSS |
v2 : v3 : |
v2 : 2.1
v3 : 4.6 |
| References | (MISC) https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210630-01-pathtraversal-en - Vendor Advisory | |
| CPE | cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.278\(c185e10r2p1\):*:*:*:*:*:*:* cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.267\(c636e10r2p1\):*:*:*:*:*:*:* cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.188\(c185e10r2p1\):*:*:*:*:*:*:* cpe:2.3:o:huawei:mate_20_firmware:9.1.0.139\(c00e133r3p1\):*:*:*:*:*:*:* cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.268\(c635e12r1p16\):*:*:*:*:*:*:* cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.266\(c432e10r1p16\):*:*:*:*:*:*:* cpe:2.3:o:huawei:hima-l29c_firmware:9.0.0.105\(c185e9r1p16\):*:*:*:*:*:*:* cpe:2.3:o:huawei:mate_20_firmware:9.0.0.195\(c01e195r2p1\):*:*:*:*:*:*:* cpe:2.3:o:huawei:tony-al00b_firmware:9.1.0.257\(c00e222r2p1\):*:*:*:*:*:*:* cpe:2.3:h:huawei:tony-al00b:-:*:*:*:*:*:*:* cpe:2.3:h:huawei:mate_20_pro:-:*:*:*:*:*:*:* cpe:2.3:h:huawei:laya-al00ep:-:*:*:*:*:*:*:* cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.187\(c432e10r1p16\):*:*:*:*:*:*:* cpe:2.3:h:huawei:mate_20:-:*:*:*:*:*:*:* cpe:2.3:o:huawei:oxfords-an00a_firmware:10.1.0.223\(c00e210r5p1\):*:*:*:*:*:*:* cpe:2.3:o:huawei:hima-l29c_firmware:9.0.0.105\(c636e9r1p16\):*:*:*:*:*:*:* cpe:2.3:o:huawei:laya-al00ep_firmware:9.1.0.139\(c786e133r3p1\):*:*:*:*:*:*:* cpe:2.3:h:huawei:oxfords-an00a:-:*:*:*:*:*:*:* cpe:2.3:h:huawei:hima-l29c:-:*:*:*:*:*:*:* cpe:2.3:o:huawei:hima-l29c_firmware:9.0.0.105\(c10e9r1p16\):*:*:*:*:*:*:* cpe:2.3:o:huawei:mate_20_pro_firmware:9.0.0.245\(c10e10r2p1\):*:*:*:*:*:*:* |
13 Jul 2021, 13:48
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-07-13 12:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-22440
Mitre link : CVE-2021-22440
CVE.ORG link : CVE-2021-22440
JSON object : View
Products Affected
huawei
- hima-l29c_firmware
- mate_20_pro_firmware
- oxfords-an00a
- mate_20_firmware
- tony-al00b_firmware
- hima-l29c
- oxfords-an00a_firmware
- tony-al00b
- mate_20
- laya-al00ep_firmware
- laya-al00ep
- mate_20_pro
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')