CVE-2024-1609 - Vulnerability Details - OpenCVE

In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1869215920048840704

History

Thu, 26 Dec 2024 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 25 Dec 2024 03:30:00 +0000

Type	Values Removed	Values Added
Description		In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.
Title		OPPO Store APP has a WebView component privilege escalation vulnerability.
Weaknesses		CWE-287
References		https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1869215920048840704
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: OPPO

Published: 2024-12-25T03:14:43.216Z

Updated: 2024-12-26T19:52:25.743Z

Reserved: 2024-02-19T07:48:58.472Z

Link: CVE-2024-1609

Vulnrichment

Updated: 2024-12-26T19:52:13.777Z

NVD

Status : Received

Published: 2024-12-25T04:15:06.750

Modified: 2024-12-25T04:15:06.750

Link: CVE-2024-1609

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1609", "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695", "state": "PUBLISHED", "assignerShortName": "OPPO", "dateReserved": "2024-02-19T07:48:58.472Z", "datePublished": "2024-12-25T03:14:43.216Z", "dateUpdated": "2024-12-26T19:52:25.743Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OPPP Store", "vendor": "OPPO", "versions": [{"status": "affected", "version": "3.10"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation. </span><br>"}], "value": "In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695", "shortName": "OPPO", "dateUpdated": "2024-12-25T03:14:43.216Z"}, "references": [{"url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1869215920048840704"}], "source": {"discovery": "UNKNOWN"}, "title": "OPPO Store APP has a WebView component privilege escalation vulnerability.", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-26T19:51:53.624999Z", "id": "CVE-2024-1609", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-26T19:52:25.743Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1609", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-26T19:51:53.624999Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-26T19:52:13.777Z"}}], "cna": {"title": "OPPO Store APP has a WebView component privilege escalation vulnerability.", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OPPO", "product": "OPPP Store", "versions": [{"status": "affected", "version": "3.10"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1869215920048840704"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation. </span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695", "shortName": "OPPO", "dateUpdated": "2024-12-25T03:14:43.216Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1609", "state": "PUBLISHED", "dateUpdated": "2024-12-26T19:52:25.743Z", "dateReserved": "2024-02-19T07:48:58.472Z", "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695", "datePublished": "2024-12-25T03:14:43.216Z", "assignerShortName": "OPPO"}, "dataVersion": "5.1"}