CVE-2020-1788

{"id": "CVE-2020-1788", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2020-01-21T23:15:13.647", "references": [{"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-02-smartphone-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability. Certain applications do not properly validate the identity of another application who would call its interface. An attacker could trick the user into installing a malicious application. Successful exploit could allow unauthorized actions leading to information disclosure."}, {"lang": "es", "value": "Los tel\u00e9fonos inteligentes Honor V30 con versiones anteriores a 10.0.1.135(C00E130R4P1), presentan una vulnerabilidad de autenticaci\u00f3n inapropiada. Ciertas aplicaciones no comprueban apropiadamente la identidad de otra aplicaci\u00f3n que llamar\u00eda a su interfaz. Un atacante podr\u00eda enga\u00f1ar al usuario para que instale una aplicaci\u00f3n maliciosa. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir acciones no autorizadas que conllevan a una divulgaci\u00f3n de informaci\u00f3n."}], "lastModified": "2020-01-24T22:03:30.393", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:honor_v30_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC7FFDFA-2349-40EA-8DBD-F308CE72F005", "versionEndExcluding": "10.0.1.135\\(c00e130r4p1\\)"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:honor_v30:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A90E11A8-FDDC-4F27-BA4F-52E158FAD83C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}