CVE-2021-22331
Description
There is a JavaScript injection vulnerability in certain Huawei smartphones. A module does not verify some inputs sufficiently. Attackers can exploit this vulnerability by sending a malicious application request to launch JavaScript injection. This may compromise normal service. Affected product versions include HUAWEI P30 versions earlier than 10.1.0.165(C01E165R2P11), 11.0.0.118(C635E2R1P3), 11.0.0.120(C00E120R2P5), 11.0.0.138(C10E4R5P3), 11.0.0.138(C185E4R7P3), 11.0.0.138(C432E8R2P3), 11.0.0.138(C461E4R3P3), 11.0.0.138(C605E4R1P3), and 11.0.0.138(C636E4R3P3).
How to fix
- huawei p30_firmware10.1.0.165\(c01e165r2p11\), 11.0.0.118\(c635e2r1p3\), 11.0.0.120\(c00e120r2p5\), 11.0.0.138\(c10e4r5p3\), 11.0.0.138\(c185e4r7p3\), 11.0.0.138\(c432e8r2p3\), 11.0.0.138\(c461e4r3p3\), 11.0.0.138\(c605e4r1p3\), 11.0.0.138\(c636e4r3p3\) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| huawei p30_firmware | v < 10.1.0.165\(c01e165r2p11\), v < 11.0.0.118\(c635e2r1p3\), v < 11.0.0.120\(c00e120r2p5\), v < 11.0.0.138\(c10e4r5p3\), v < 11.0.0.138\(c185e4r7p3\), v < 11.0.0.138\(c432e8r2p3\), v < 11.0.0.138\(c461e4r3p3\), v < 11.0.0.138\(c605e4r1p3\), v < 11.0.0.138\(c636e4r3p3\) | 10.1.0.165\(c01e165r2p11\), 11.0.0.118\(c635e2r1p3\), 11.0.0.120\(c00e120r2p5\), 11.0.0.138\(c10e4r5p3\), 11.0.0.138\(c185e4r7p3\), 11.0.0.138\(c432e8r2p3\), 11.0.0.138\(c461e4r3p3\), 11.0.0.138\(c605e4r1p3\), 11.0.0.138\(c636e4r3p3\) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.