Medium severity · published Nov 3, 2022
CVE-2022-43451
Multiple path traversal in appspawn and nwebspawn services.
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary directories or escape application sandbox.If chained with other vulnerabilities it would allow an unprivileged process to gain full root privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenHarmony · OpenHarmony
3.1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43451
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43451
Third Party Advisory
https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.md
More from OpenHarmony
9.8
CVE-2024-37077
Arkcompiler Ets Runtime has an out-of-bounds write vulnerability
9.8
CVE-2024-37185
Arkcompiler Ets Runtime has an out-of-bounds write vulnerability
9.8
CVE-2024-36260
Arkcompiler Ets Runtime has an out-of-bounds write vulnerability
9.8
CVE-2024-36243
Arkcompiler Ets Runtime has an out-of-bounds read vulnerability
9.8
CVE-2024-37030
Arkcompiler Ets Runtime has a use after free vulnerability