title: The appspawn and nwebspawn services were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation.
description: The appspawn and nwebspawn services within OpenHarmony-v3.1.2 and prior versions were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation. An unprivileged malicious application would be able to gain code execution within any application installed on the device or cause application crash.
problem types: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
affected:
{
vendor: OpenHarmony
product: OpenHarmony
versions:
version: 3.1.0, status: affected
version: 3.0.0, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL