CVE-2019-5309

Honor play smartphones with versions earlier than 9.1.0.333(C00E333R1P1T8) have an information disclosure vulnerability in certain Huawei . An attacker could view certain information after a series of operation without unlock the screen lock. Successful exploit could cause an information disclosure condition.

CVSS v3 4.6 MEDIUM
CVSS v2.0 2.1 LOW

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-02-smartphone-en	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:huawei:honor_play_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:huawei:honor_play:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-11-29 21:15

Updated : 2024-02-28 17:28

NVD link : CVE-2019-5309

Mitre link : CVE-2019-5309

CVE.ORG link : CVE-2019-5309

JSON object : View

Products Affected

huawei

honor_play_firmware
honor_play

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2019-5309", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2019-11-29T21:15:11.543", "references": [{"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-02-smartphone-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "Honor play smartphones with versions earlier than 9.1.0.333(C00E333R1P1T8) have an information disclosure vulnerability in certain Huawei . An attacker could view certain information after a series of operation without unlock the screen lock. Successful exploit could cause an information disclosure condition."}, {"lang": "es", "value": "Los tel\u00e9fonos inteligentes Honor Play con versiones anteriores a 9.1.0.333 (C00E333R1P1T8), presentan una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en ciertos Huawei. Un atacante podr\u00eda visualizar determinada informaci\u00f3n luego de una serie de operaciones sin desbloquear el bloqueo de pantalla. Una explotaci\u00f3n con \u00e9xito podr\u00eda causar una condici\u00f3n de divulgaci\u00f3n de informaci\u00f3n."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:honor_play_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C35AF45-7909-4498-B82B-AE105988F0F9", "versionEndExcluding": "9.1.0.333\\(c00e333r1p1t8\\)"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:honor_play:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9B4BC963-31B0-4731-8D15-3EFD00E463BE"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}