CVE-2018-11922 - Vulnerability Details - OpenCVE

ReportizFlow

Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html

History

Tue, 26 Nov 2024 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 26 Nov 2024 09:15:00 +0000

Type	Values Removed	Values Added
Description		Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.
Title		Configurations in Android Build
Weaknesses		CWE-16
References		https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: qualcomm

Published: 2024-11-26T08:55:23.774Z

Updated: 2024-11-26T14:09:23.135Z

Reserved: 2018-06-07T00:00:00.000Z

Link: CVE-2018-11922

Vulnrichment

Updated: 2024-11-26T14:02:18.958Z

NVD

Status : Received

Published: 2024-11-26T09:15:04.927

Modified: 2024-11-26T09:15:04.927

Link: CVE-2018-11922

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2018-11922", "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "state": "PUBLISHED", "assignerShortName": "qualcomm", "dateReserved": "2018-06-07T00:00:00.000Z", "datePublished": "2024-11-26T08:55:23.774Z", "dateUpdated": "2024-11-26T14:09:23.135Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Snapdragon Auto", "Snapdragon Consumer IOT", "Snapdragon Industrial IOT", "Snapdragon Mobile", "Snapdragon Wearables"], "product": "Snapdragon", "vendor": "Qualcomm, Inc.", "versions": [{"status": "affected", "version": "MDM9206"}, {"status": "affected", "version": "MDM9607"}, {"status": "affected", "version": "MDM9640"}, {"status": "affected", "version": "MDM9650"}, {"status": "affected", "version": "Qualcomm 215"}, {"status": "affected", "version": "SD 210/SD 212/SD 205"}, {"status": "affected", "version": "SD 425"}, {"status": "affected", "version": "SD 427"}, {"status": "affected", "version": "SD 430"}, {"status": "affected", "version": "SD 435"}, {"status": "affected", "version": "SD 439 / SD 429"}, {"status": "affected", "version": "SD 450"}, {"status": "affected", "version": "SD 625"}, {"status": "affected", "version": "SD 632"}, {"status": "affected", "version": "SD 845 / SD 850"}, {"status": "affected", "version": "SDA660"}, {"status": "affected", "version": "SDM439"}, {"status": "affected", "version": "SDX20"}]}], "descriptions": [{"lang": "en", "value": "Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-16", "description": "CWE-16 Configuration", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "shortName": "qualcomm", "dateUpdated": "2024-11-26T08:55:23.774Z"}, "references": [{"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html"}], "title": "Configurations in Android Build"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2018-11922", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-26T14:02:16.711521Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-26T14:09:23.135Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2018-11922", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-26T14:02:16.711521Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-26T14:02:18.958Z"}}], "cna": {"title": "Configurations in Android Build", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Qualcomm, Inc.", "product": "Snapdragon", "versions": [{"status": "affected", "version": "MDM9206"}, {"status": "affected", "version": "MDM9607"}, {"status": "affected", "version": "MDM9640"}, {"status": "affected", "version": "MDM9650"}, {"status": "affected", "version": "Qualcomm 215"}, {"status": "affected", "version": "SD 210/SD 212/SD 205"}, {"status": "affected", "version": "SD 425"}, {"status": "affected", "version": "SD 427"}, {"status": "affected", "version": "SD 430"}, {"status": "affected", "version": "SD 435"}, {"status": "affected", "version": "SD 439 / SD 429"}, {"status": "affected", "version": "SD 450"}, {"status": "affected", "version": "SD 625"}, {"status": "affected", "version": "SD 632"}, {"status": "affected", "version": "SD 845 / SD 850"}, {"status": "affected", "version": "SDA660"}, {"status": "affected", "version": "SDM439"}, {"status": "affected", "version": "SDX20"}], "platforms": ["Snapdragon Auto", "Snapdragon Consumer IOT", "Snapdragon Industrial IOT", "Snapdragon Mobile", "Snapdragon Wearables"], "defaultStatus": "unaffected"}], "references": [{"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html"}], "descriptions": [{"lang": "en", "value": "Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-16", "description": "CWE-16 Configuration"}]}], "providerMetadata": {"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "shortName": "qualcomm", "dateUpdated": "2024-11-26T08:55:23.774Z"}}}, "cveMetadata": {"cveId": "CVE-2018-11922", "state": "PUBLISHED", "dateUpdated": "2024-11-26T14:09:23.135Z", "dateReserved": "2018-06-07T00:00:00.000Z", "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "datePublished": "2024-11-26T08:55:23.774Z", "assignerShortName": "qualcomm"}, "dataVersion": "5.1"}