CVE-2022-45118 Telephony in communication subsystem sends public events with personal data, but the permission is not set.
Malicious apps can access sensitive telephony data like mobile numbers and SMS by listening to unprotected public events in OpenHarmony.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-45118?
CVE-2022-45118 is a medium-severity vulnerability in OpenHarmony, published on 8 Dec 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission is not set. Malicious apps could listen to public events and obtain information such as mobile numbers and SMS data without permissions.
Which versions are affected by CVE-2022-45118?
It affects 1 product.
Products include Openharmony Openharmony.
How do I fix CVE-2022-45118?
No fix has been published for CVE-2022-45118 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-45118 being exploited?
There is no known exploitation of CVE-2022-45118 in the wild and no public exploit code.
Other vulnerabilities in OpenHarmony
Sources
Also known as GHSA-prq4-rjxr-m2fq.