cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2...
Vulnerability Description
cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and execute arbitrary Java code by leveraging a network position between the client and the registry to block HTTPS traffic.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-2271
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-401529.htm
- http://www.securityfocus.com/bid/71381
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99089
- https://labs.f-secure.com/advisories/kingsoft-office-remote-code-execution/
- https://labs.f-secure.com/assets/763/original/mwri_advisory_huawei_kingsoft-office.pdf
More from wps
View All →Affected Vendor
Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.