Huawei Mate 20 X Huawei Share path traversal

Summaryinfo

A vulnerability classified as critical has been found in Huawei Mate 20 X. Impacted is an unknown function of the component Huawei Share. Performing a manipulation results in path traversal. This vulnerability was named CVE-2019-5221. The attack needs to be approached within the local network. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, was found in Huawei Mate 20 X (Smartphone Operating System) (version now known). This affects some unknown processing of the component Huawei Share. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

There is a path traversal vulnerability on Huawei Share. The software does not properly validate the path, an attacker could crafted a file path when transporting file through Huawei Share, successful exploit could allow the attacker to transport a file to arbitrary path on the phone. Affected products: Mate 20 X versions earlier than Ever-L29B 9.1.0.300(C432E3R1P12), versions earlier than Ever-L29B 9.1.0.300(C636E3R2P1), and versions earlier than Ever-L29B 9.1.0.300(C185E3R3P1).

The weakness was presented 07/10/2019 (Website). It is possible to read the advisory at huawei.com. This vulnerability is uniquely identified as CVE-2019-5221 since 01/04/2019. The exploitability is told to be easy. Access to the local network is required for this attack to succeed. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 10/24/2023). The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Huawei

Name

• Mate 20 X

License

• commercial

Website

• Vendor: https://www.huawei.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion