Information disclosure in Huawei Files
CVE-2017-2715
The Files APP 7.1.1.309 and earlier versions in some Huawei mobile phones has a brute-force password cracking vulnerability due to the improper design of the Safe key database. An unauthorized attacker could access sensitive database information and may crack users' Safe passwords, leading to information leak.
Vulnerability class: Information Disclosure
EPSS: 0.003 (16.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Huawei Files
- Huawei Technologies Co., Ltd. Files £¨files Is The Smartphone App£© — versions 7.1.1.309 and earlier versions
Weakness classification (CWE)
References
- psirt@huawei.com (x_refsource_CONFIRM, VDB Entry)
Frequently asked questions
- What is CVE-2017-2715?
- CVE-2017-2715 is a high-severity vulnerability in Huawei Files, classified under Information Disclosure. CVSS score: 7.8/10. Published 2017-11-22.
- How severe is CVE-2017-2715?
- High severity. CVSS v3 base score is 7.8 out of 10.