« Volver al listado

CVE-2021-23246

Estado: ModificadaAlta (7.5)—

In ACE2 ColorOS11, the attacker can obtain the foreground package name through permission promotion, resulting in user information disclosure.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Oppo — Coloros

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-23246",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@oppo.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "ACE2",
          "versions": [
            {
              "status": "affected",
              "version": "ColorOS 11"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-03-11T18:15:09.650",
  "references": [
    {
      "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1502209104851247104",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@oppo.com"
    },
    {
      "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1502209104851247104",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In ACE2 ColorOS11, the attacker can obtain the foreground package name through permission promotion, resulting in user information disclosure."
    },
    {
      "lang": "es",
      "value": "En ACE2 ColorOS11, el atacante puede obtener el nombre del paquete en primer plano mediante la promoción de permisos, resultando en una divulgación de información del usuario"
    }
  ],
  "lastModified": "2026-06-17T03:38:28.497",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:oppo:coloros:11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "720FF3AC-0354-4E6E-B73D-B9BCEE86CCFA"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:oppo:ace2:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F75FA403-684A-4C26-80A2-C102EFAC404D"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@oppo.com"
}