« Volver al listado

CVE-2022-43451

Estado: ModificadaMedia (6.5)—

OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary directories or escape application sandbox.If chained with other vulnerabilities it would allow an unprivileged process to gain full root privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openharmony — Openharmony

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-43451",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "scy@openharmony.io",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "scy@openharmony.io",
      "affectedData": [
        {
          "vendor": "OpenHarmony",
          "product": "OpenHarmony",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-11-03T20:15:33.867",
  "references": [
    {
      "url": "https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "scy@openharmony.io"
    },
    {
      "url": "https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "scy@openharmony.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary directories or escape application sandbox.If chained with other vulnerabilities it would allow an unprivileged process to gain full root privileges."
    },
    {
      "lang": "es",
      "value": "OpenHarmony-v3.1.2 y versiones anteriores tenían una vulnerabilidad de Multiple path traversal en los servicios appspawn y nwebspawn. Los atacantes locales pueden crear directorios arbitrarios o escapar de la zona de pruebas de la aplicación. Si se encadena con otras vulnerabilidades, permitiría que un proceso sin privilegios obtuviera privilegios completos del root."
    }
  ],
  "lastModified": "2026-06-17T05:06:34.237",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openharmony:openharmony:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C026D184-A8AE-4DE6-A339-EA4469DDD4E7",
              "versionEndIncluding": "3.1.2",
              "versionStartIncluding": "3.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "scy@openharmony.io"
}