CVE-2022-43451 Multiple path traversal in appspawn and nwebspawn services.
Local attackers can exploit path traversal in appspawn and nwebspawn services to escape sandboxes and potentially gain root privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-43451?
CVE-2022-43451 is a high-severity path traversal vulnerability in OpenHarmony, published on 3 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary directories or escape application sandbox.If chained with other vulnerabilities it would allow an unprivileged process to gain full root privileges.
Which versions are affected by CVE-2022-43451?
It affects 1 product.
Products include Openharmony Openharmony.
How do I fix CVE-2022-43451?
No fix has been published for CVE-2022-43451 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-43451 being exploited?
There is no known exploitation of CVE-2022-43451 in the wild and no public exploit code.
Other vulnerabilities in OpenHarmony
Sources
Also known as GHSA-pmwg-pqhj-8m9m.