CVE-2022-45118: Telephony in communication subsystem sends public events with personal data, but the permission is not set.
OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission is not set. Malicious apps could listen to public events and obtain information such as mobile numbers and SMS data without permissions.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-45118?
CVE-2022-45118 refers to a vulnerability in OpenHarmony-v3.1.2 and prior versions where the telephony in the communication subsystem sends public events with personal data without proper permissions.
What is the severity of CVE-2022-45118?
The severity of CVE-2022-45118 is medium with a CVSS score of 5.5.
How does CVE-2022-45118 impact OpenHarmony?
CVE-2022-45118 allows malicious apps to listen to public events in OpenHarmony and obtain personal information such as mobile numbers and SMS data without proper permissions.
How can I fix CVE-2022-45118 in OpenHarmony?
To mitigate CVE-2022-45118, it is recommended to update OpenHarmony to version 3.1.4 or later.
Where can I find more information about CVE-2022-45118?
You can find more information about CVE-2022-45118 at the following link: [https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.md](https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.md)