CVE-2019-5250

Mate 20 Pro smartphones with versions earlier than 9.1.0.135(C00E133R3P1) have an improper authorization vulnerability. The software does not properly restrict certain operation of certain privilege, the attacker could trick the user into installing a malicious application before the user turns on student mode function. Successful exploit could allow the attacker to bypass the limit of student mode function.

CVSS v3 7.8 HIGH
CVSS v2.0 6.8 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-02-smartphone-en	Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-02-smartphone-en	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:huawei:mate_20_pro_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:huawei:mate_20_pro:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:44

Type	Values Removed	Values Added
References	~~() https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-02-smartphone-en - Vendor Advisory~~	() https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-02-smartphone-en - Vendor Advisory

Information

Published : 2019-12-13 15:15

Updated : 2024-11-21 04:44

NVD link : CVE-2019-5250

Mitre link : CVE-2019-5250

CVE.ORG link : CVE-2019-5250

JSON object : View

Products Affected

huawei

mate_20_pro_firmware
mate_20_pro

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2019-5250", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-12-13T15:15:11.240", "references": [{"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-02-smartphone-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}, {"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-02-smartphone-en", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Mate 20 Pro smartphones with versions earlier than 9.1.0.135(C00E133R3P1) have an improper authorization vulnerability. The software does not properly restrict certain operation of certain privilege, the attacker could trick the user into installing a malicious application before the user turns on student mode function. Successful exploit could allow the attacker to bypass the limit of student mode function."}, {"lang": "es", "value": "Los tel\u00e9fonos inteligentes Mate 20 Pro con versiones anteriores a 9.1.0.135 (C00E133R3P1), presentan una vulnerabilidad de autorizaci\u00f3n inapropiada. El software no restringe apropiadamente determinadas operaciones con ciertos privilegios, el atacante podr\u00eda enga\u00f1ar al usuario para que instale una aplicaci\u00f3n maliciosa versiones anteriores a que el usuario active la funci\u00f3n del modo estudiante. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante omitir el l\u00edmite de la funci\u00f3n del modo estudiante."}], "lastModified": "2024-11-21T04:44:36.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:mate_20_pro_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEE8C965-9DA7-4EAD-8834-3EE36020F9DF", "versionEndExcluding": "9.1.0.135\\(c00e133r3p1\\)"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:mate_20_pro:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2564E28F-EF08-4381-96D8-58BB7C8C0E0C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}