title: The ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access.
description: The ArKUI framework subsystem within OpenHarmony-v3.1.5 and prior versions,
OpenHarmony-v3.0.7 and prior versions
has an Improper Input Validation vulnerability which local attackers can exploit this vulnerability to send malicious data, causing the current application to crash.
problem types: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
affected:
{
defaultStatus: unaffected
product: OpenHarmony
vendor: OpenHarmony
versions:
lessThanOrEqual: 3.0.7, status: affected, version: 3.0, versionType: custom
lessThanOrEqual: 3.1.5, status: affected, version: 3.1, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL