Vulnerability-Lookup

VAR-201712-0796

Vulnerability from variot - Updated: 2025-04-20 23:32
Huawei iReader app before 8.0.2.301 has a path traversal vulnerability due to insufficient validation on file storage paths. An attacker can exploit this vulnerability to store downloaded malicious files in an arbitrary directory. Huawei iReader The application contains a path traversal vulnerability.Tampering with information and disrupting service operations (DoS) There is a possibility of being put into a state. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the handling of the onChapPack function. Huawei iReader is a built-in e-book reading application for Huawei mobile phones produced by China's Huawei (Huawei)
Show details on source website
JSON
To clipboard
{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201712-0796",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ireader",
        "scope": "lt",
        "trust": 1.8,
        "vendor": "huawei",
        "version": "8.0.2.301"
      },
      {
        "model": "reader",
        "scope": null,
        "trust": 1.4,
        "vendor": "huawei",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-18-878"
      },
      {
        "db": "ZDI",
        "id": "ZDI-18-874"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011592"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-15309"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:huawei:ireader",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011592"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "MWR Labs - Alex Plaskett James Loureiro Robert Miller and Georgi Geshev",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-18-878"
      },
      {
        "db": "ZDI",
        "id": "ZDI-18-874"
      }
    ],
    "trust": 1.4
  },
  "cve": "CVE-2017-15309",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2017-15309",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "ZDI",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "id": "CVE-2017-15309",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "MEDIUM",
            "trust": 0.7,
            "userInteractionRequired": null,
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "ZDI",
            "availabilityImpact": "PARTIAL",
            "baseScore": 3.6,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2017-15309",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "LOW",
            "trust": 0.7,
            "userInteractionRequired": null,
            "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-106118",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 2.8,
            "id": "CVE-2017-15309",
            "impactScore": 4.2,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-15309",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-15309",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "ZDI",
            "id": "CVE-2017-15309",
            "trust": 0.7,
            "value": "MEDIUM"
          },
          {
            "author": "ZDI",
            "id": "CVE-2017-15309",
            "trust": 0.7,
            "value": "LOW"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201710-467",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-106118",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-18-878"
      },
      {
        "db": "ZDI",
        "id": "ZDI-18-874"
      },
      {
        "db": "VULHUB",
        "id": "VHN-106118"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011592"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201710-467"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-15309"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Huawei iReader app before 8.0.2.301 has a path traversal vulnerability due to insufficient validation on file storage paths. An attacker can exploit this vulnerability to store downloaded malicious files in an arbitrary directory. Huawei iReader The application contains a path traversal vulnerability.Tampering with information and disrupting service operations (DoS) There is a possibility of being put into a state. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the handling of the onChapPack function. Huawei iReader is a built-in e-book reading application for Huawei mobile phones produced by China\u0027s Huawei (Huawei)",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-15309"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011592"
      },
      {
        "db": "ZDI",
        "id": "ZDI-18-878"
      },
      {
        "db": "ZDI",
        "id": "ZDI-18-874"
      },
      {
        "db": "VULHUB",
        "id": "VHN-106118"
      }
    ],
    "trust": 2.97
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-15309",
        "trust": 3.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011592",
        "trust": 0.8
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-5349",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-18-878",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-5350",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-18-874",
        "trust": 0.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201710-467",
        "trust": 0.7
      },
      {
        "db": "VULHUB",
        "id": "VHN-106118",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-18-878"
      },
      {
        "db": "ZDI",
        "id": "ZDI-18-874"
      },
      {
        "db": "VULHUB",
        "id": "VHN-106118"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011592"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201710-467"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-15309"
      }
    ]
  },
  "id": "VAR-201712-0796",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-106118"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2025-04-20T23:32:46.789000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "huawei-sa-20171120-01-hwreader",
        "trust": 2.2,
        "url": "http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171120-01-hwreader-en"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-18-878"
      },
      {
        "db": "ZDI",
        "id": "ZDI-18-874"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011592"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-22",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-106118"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011592"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-15309"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171120-01-hwreader-en"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-15309"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-15309"
      },
      {
        "trust": 0.6,
        "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171120-01-hwreader-en"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-18-878"
      },
      {
        "db": "ZDI",
        "id": "ZDI-18-874"
      },
      {
        "db": "VULHUB",
        "id": "VHN-106118"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011592"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201710-467"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-15309"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "ZDI",
        "id": "ZDI-18-878"
      },
      {
        "db": "ZDI",
        "id": "ZDI-18-874"
      },
      {
        "db": "VULHUB",
        "id": "VHN-106118"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011592"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201710-467"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-15309"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-08-02T00:00:00",
        "db": "ZDI",
        "id": "ZDI-18-878"
      },
      {
        "date": "2018-08-02T00:00:00",
        "db": "ZDI",
        "id": "ZDI-18-874"
      },
      {
        "date": "2017-12-22T00:00:00",
        "db": "VULHUB",
        "id": "VHN-106118"
      },
      {
        "date": "2018-01-22T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-011592"
      },
      {
        "date": "2017-11-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201710-467"
      },
      {
        "date": "2017-12-22T17:29:12.970000",
        "db": "NVD",
        "id": "CVE-2017-15309"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-08-02T00:00:00",
        "db": "ZDI",
        "id": "ZDI-18-878"
      },
      {
        "date": "2018-08-02T00:00:00",
        "db": "ZDI",
        "id": "ZDI-18-874"
      },
      {
        "date": "2018-01-05T00:00:00",
        "db": "VULHUB",
        "id": "VHN-106118"
      },
      {
        "date": "2018-01-22T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-011592"
      },
      {
        "date": "2017-12-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201710-467"
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2017-15309"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201710-467"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Huawei iReader Application path traversal vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011592"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "path traversal",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201710-467"
      }
    ],
    "trust": 0.6
  }
}
CVE-2017-15309 (GCVE-0-2017-15309)

Vulnerability from cvelistv5 – Published: 2017-12-22 17:00 – Updated: 2024-09-16 22:30
Summary
Severity ?
No CVSS data available.
CWE
path traversal
Assigner
huawei
References
URL
	Vendor	Product	Version
	Huawei Technologies Co., Ltd.	iReader	Affected: before 8.0.2.301
Sightings

Author	Source	Type	Date
Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Detection rules are retrieved from Rulezet.
Action not permitted

VAR-201712-0796

CVE-2017-15309 (GCVE-0-2017-15309)

Tags

Sightings

Nomenclature
