CVE-2014-2271: Input Validation
cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and execute arbitrary Java code by leveraging a network position between the client and the registry to block HTTPS traffic.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2271?
CVE-2014-2271 is classified as a medium severity vulnerability due to its potential for man-in-the-middle attacks.
How do I fix CVE-2014-2271?
To mitigate CVE-2014-2271, ensure that you are using a version of Kingsoft Office that is later than 5.3.1 and ensure secure HTTPS connections are enforced.
Which devices are affected by CVE-2014-2271?
CVE-2014-2271 affects Kingsoft Office version 5.3.1 and Huawei P2 devices running firmware versions prior to V100R001C00B043.
What does CVE-2014-2271 allow attackers to do?
CVE-2014-2271 allows attackers to execute arbitrary Java code by exploiting the fallback from HTTPS to HTTP.
Is there a workaround for CVE-2014-2271 while waiting for a patch?
A temporary workaround for CVE-2014-2271 is to avoid using any features of Kingsoft Office that require cloud printing until an official fix is applied.