Vulnerability Description
cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and execute arbitrary Java code by leveraging a network position between the client and the registry to block HTTPS traffic.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wps | Wps Office | 5.3.1 |
| Huawei | P2-6011 Firmware | < v100r001c00b043 |
| Huawei | P2-6011 | - |
Related Weaknesses (CWE)
References
- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hThird Party Advisory
- http://www.securityfocus.com/bid/71381Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99089Third Party AdvisoryVDB Entry
- https://labs.f-secure.com/advisories/kingsoft-office-remote-code-execution/Third Party Advisory
- https://labs.f-secure.com/assets/763/original/mwri_advisory_huawei_kingsoft-offiThird Party Advisory
- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hThird Party Advisory
- http://www.securityfocus.com/bid/71381Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99089Third Party AdvisoryVDB Entry
- https://labs.f-secure.com/advisories/kingsoft-office-remote-code-execution/Third Party Advisory
- https://labs.f-secure.com/assets/763/original/mwri_advisory_huawei_kingsoft-offiThird Party Advisory
FAQ
What is CVE-2014-2271?
CVE-2014-2271 is a vulnerability with a CVSS score of 8.1 (HIGH). cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the HTTPS connection to the registry fails, w...
How severe is CVE-2014-2271?
CVE-2014-2271 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-2271?
Check the references section above for vendor advisories and patch information. Affected products include: Wps Wps Office, Huawei P2-6011 Firmware, Huawei P2-6011.