1. Home
  2. CVE Database
  3. CVE-2022-42488
HIGH · 8.4

CVE-2022-42488

OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application installed on the device could elevate its privi...

Vulnerability Description

OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS by disabling particular services.

CVSS Score

8.4

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
OpenharmonyOpenharmony>= 3.1, < 3.1.2

Related Weaknesses (CWE)

CWE-287CWE-862

References

FAQ

What is CVE-2022-42488?

CVE-2022-42488 is a vulnerability with a CVSS score of 8.4 (HIGH). OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application installed on the device could elevate its privi...

How severe is CVE-2022-42488?

CVE-2022-42488 has been rated HIGH with a CVSS base score of 8.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-42488?

Check the references section above for vendor advisories and patch information. Affected products include: Openharmony Openharmony.