OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission is not set. Malicious apps could listen to public events and obtain information such as mobile numbers and SMS data without permissions.
References
| Link | Resource |
|---|---|
| https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.md | Third Party Advisory |
Configurations
History
12 Dec 2022, 17:00
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-276 | |
| CPE | cpe:2.3:a:openharmony:openharmony:*:*:*:*:*:*:*:* | |
| First Time |
Openharmony
Openharmony openharmony |
|
| References | (MISC) https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.md - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
08 Dec 2022, 16:29
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-12-08 16:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-45118
Mitre link : CVE-2022-45118
CVE.ORG link : CVE-2022-45118
JSON object : View
Products Affected
openharmony
- openharmony