CVE-2018-14986 Information disclosure in n/a

What is CVE-2018-14986?

CVE-2018-14986 is a high-severity vulnerability in n/a, published on 28 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed app with a package name of com.android.messaging (versionCode=1000110, versionName=1.0.001, (android.20170630.092853-0)) containing an exported content provider named com.android.messaging.datamodel.MessagingContentProvider. Any app co-located on the device can read the most recent text message from each conversation. That is, for each phone number where the user has either sent or received a text message from, a zero-permission third-party app can obtain the body of the text message, phone number, name of the contact (if it exists), and a timestamp for the most recent text message of each conversation. As the querying of the vulnerable content provider app component can be performed silently in the background, a malicious app can continuously monitor the content provider to see if the current message in each conversation has changed to obtain new text messages.

Weakness: CWE-200

Which versions are affected by CVE-2018-14986?

It affects 1 product.

Products include Leagoo Z5c Firmware.

How do I fix CVE-2018-14986?

No fix has been published for CVE-2018-14986 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-14986 being exploited?

There is no known exploitation of CVE-2018-14986 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-14984 Missing authorization in n/a High 7.5
• CVE-2018-14985 Missing authorization in n/a High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-355x-p35f-mgjw.