Medium · 6.2 CVE-2022-38081 EUVD-2022-40683GHSA-vpg2-7cp7-xh7g

Tokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.

Published Sep 9, 2022 · Updated Sep 16, 2024 · Assigned by OpenHarmony

Vendor: OpenHarmony Product: OpenHarmony

Description

OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.

Affected products

Vendor	Product	Affected	Fixed
OpenHarmony	OpenHarmony	OpenHarmony-v3.1.x-Release – ≤ 3.1.2	—

References

https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md