Medium severity · published Dec 8, 2022
CVE-2022-45118
Telephony in communication subsystem sends public events with personal data, but the permission is not set.
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission is not set. Malicious apps could listen to public events and obtain information such as mobile numbers and SMS data without permissions.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenHarmony · OpenHarmony
3.1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45118
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45118
Third Party Advisory
https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.md
More from OpenHarmony
9.8
CVE-2024-37077
Arkcompiler Ets Runtime has an out-of-bounds write vulnerability
9.8
CVE-2024-37185
Arkcompiler Ets Runtime has an out-of-bounds write vulnerability
9.8
CVE-2024-36260
Arkcompiler Ets Runtime has an out-of-bounds write vulnerability
9.8
CVE-2024-36243
Arkcompiler Ets Runtime has an out-of-bounds read vulnerability
9.8
CVE-2024-37030
Arkcompiler Ets Runtime has a use after free vulnerability