CVE-2022-38081

Tokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.

State: Published
Severity: 6.2 Medium
Published: Sep 9, 2022
Updated: Sep 16, 2024
Reserved: Sep 4, 2022

Read the record on cve.org

Description

OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.

Scores

CVSS	Score	Vector	Source
3.1	6.2 Medium	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	OpenHarmony

Weaknesses

CWE-305 Authentication Bypass by Primary Weakness

Affected Products

Product	Versions
OpenHarmonyOpenHarmony	OpenHarmony-v3.1.x-Release through 3.1.2Affected

References

https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.