nvd-json-data-feeds/CVE-2019/CVE-2019-142xx/CVE-2019-14220.json

{
  "id": "CVE-2019-14220",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2019-09-24T21:15:10.177",
  "lastModified": "2021-09-08T17:22:15.877",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. BlueStacks employs Android running in a virtual machine (VM) to enable Android apps to run on Windows or MacOS. Bug is in a local arbitrary file read through a system service call. The impacted method runs with System admin privilege and if given the file name as parameter returns you the content of file. A malicious app using the affected method can then read the content of any system file which it is not authorized to read"
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3 un problema en BlueStacks versi\u00f3n 4.110 y posteriores sobre macOS y en versi\u00f3n 4.120 y posteriores sobre Windows. BlueStacks emplea Android que es ejecutado en una m\u00e1quina virtual (VM) para permitir que las aplicaciones de Android se ejecuten en Windows o MacOS. El bug est\u00e1 en un archivo local arbitrario le\u00eddo por medio de una llamada de servicio de sistema. El m\u00e9todo afectado es ejecutado con privilegios administrativos System y, si se le da el nombre de archivo como par\u00e1metro, devuelve el contenido del archivo. Una aplicaci\u00f3n maliciosa usando el m\u00e9todo afectado puede entonces leer el contenido de cualquier archivo de sistema que no est\u00e9 autorizado para leer."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 4.0
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N",
          "accessVector": "LOCAL",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.9
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 3.9,
        "impactScore": 6.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:bluestacks:bluestacks:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "4.120",
              "matchCriteriaId": "9818754B-5A94-4168-92EC-4D90FA5DCA69"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:bluestacks:bluestacks:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "4.110",
              "matchCriteriaId": "26206BB6-681F-495B-BA9D-41237F581F42"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.bluestacks.com/hc/en-us/articles/360021469391-Release-Notes",
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://support.bluestacks.com/hc/en-us/articles/360033484132-BlueStacks-fails-to-restrict-access-permissions",
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}