What is CVE-2022-42488?

CVE-2022-42488 is a high-severity vulnerability in Openharmony, classified under Improper Authentication. CVSS score: 8.4/10. Published 2022-10-14.

How severe is CVE-2022-42488?

High severity. CVSS v3 base score is 8.4 out of 10.

Auth bypass in Openharmony

CVE-2022-42488

OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS by disabling particular services.

Vulnerability class: Broken Authentication

EPSS: 0.002 (7.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Openharmony — versions OpenHarmony-v3.1.x-Release

Weakness classification (CWE)

CWE-287 — Improper Authentication
CWE-862 — Missing Authorization

References

scy@openharmony.io (Third Party Advisory)

Frequently asked questions

What is CVE-2022-42488?: CVE-2022-42488 is a high-severity vulnerability in Openharmony, classified under Improper Authentication. CVSS score: 8.4/10. Published 2022-10-14.
How severe is CVE-2022-42488?: High severity. CVSS v3 base score is 8.4 out of 10.