{"api_version":"1","generated_at":"2026-04-23T04:09:12+00:00","cve":"CVE-2014-2388","urls":{"html":"https://cve.report/CVE-2014-2388","api":"https://cve.report/api/cve/CVE-2014-2388.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-2388","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-2388"},"summary":{"title":"CVE-2014-2388","description":"The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for SMB filesystem access, which allows context-dependent attackers to read arbitrary files via (1) a session over a Wi-Fi network or (2) a session over a USB connection in Development Mode.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2014-08-18 11:15:00","updated_at":"2018-10-09 19:43:00"},"problem_types":["CWE-264"],"metrics":[],"references":[{"url":"http://www.securityfocus.com/bid/69217","name":"69217","refsource":"BID","tags":[],"title":"BlackBerry Z10 CVE-2014-2388 Authentication Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/60156","name":"60156","refsource":"SECUNIA","tags":[],"title":"Security Advisory SA60156 - BlackBerry OS File Sharing Authentication Bypass Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/127850/BlackBerry-Z10-Authentication-Bypass.html","name":"http://packetstormsecurity.com/files/127850/BlackBerry-Z10-Authentication-Bypass.html","refsource":"MISC","tags":[],"title":"BlackBerry Z10 Authentication Bypass ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/95263","name":"blackberry-cve20141470-sec-bypass(95263)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.blackberry.com/btsc/KB36174","name":"http://www.blackberry.com/btsc/KB36174","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"KB36174-BSRT-2014-006 Vulnerability in file sharing service affects BlackBerry Z10, BlackBerry Z30, BlackBerry Q10, and BlackBerry Q5 smartphones","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/95262","name":"blackberry-z10-cve20142388-sec-bypass(95262)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/127850","name":"http://packetstormsecurity.com/files/127850","refsource":"MISC","tags":["Exploit"],"title":"BlackBerry Z10 Authentication Bypass ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.modzero.ch/advisories/MZ-13-04-Blackberry_Z10-File-Exchange-Authentication-By-Pass.txt","name":"http://www.modzero.ch/advisories/MZ-13-04-Blackberry_Z10-File-Exchange-Authentication-By-Pass.txt","refsource":"MISC","tags":["Exploit"],"title":"","mime":"text/plain","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/533118/100/0/threaded","name":"20140812 BlackBerry Z 10 - Storage and Access File-Exchange Authentication By-Pass [MZ-13-04]","refsource":"BUGTRAQ","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2388","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2388","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"2388","vulnerable":"1","versionEndIncluding":"10.1.0.2354","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"blackberry","cpe5":"blackberry_os","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2388","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"blackberry","cpe5":"q10","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2388","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"blackberry","cpe5":"q10","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2388","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"blackberry","cpe5":"q5","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2388","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"blackberry","cpe5":"q5","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2388","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"blackberry","cpe5":"z10","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2388","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"blackberry","cpe5":"z10","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2388","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"blackberry","cpe5":"z30","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2388","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"blackberry","cpe5":"z30","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-2388","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for SMB filesystem access, which allows context-dependent attackers to read arbitrary files via (1) a session over a Wi-Fi network or (2) a session over a USB connection in Development Mode."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://packetstormsecurity.com/files/127850/BlackBerry-Z10-Authentication-Bypass.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/127850/BlackBerry-Z10-Authentication-Bypass.html"},{"name":"http://packetstormsecurity.com/files/127850","refsource":"MISC","url":"http://packetstormsecurity.com/files/127850"},{"name":"blackberry-z10-cve20142388-sec-bypass(95262)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/95262"},{"name":"60156","refsource":"SECUNIA","url":"http://secunia.com/advisories/60156"},{"name":"http://www.blackberry.com/btsc/KB36174","refsource":"CONFIRM","url":"http://www.blackberry.com/btsc/KB36174"},{"name":"blackberry-cve20141470-sec-bypass(95263)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/95263"},{"name":"69217","refsource":"BID","url":"http://www.securityfocus.com/bid/69217"},{"name":"http://www.modzero.ch/advisories/MZ-13-04-Blackberry_Z10-File-Exchange-Authentication-By-Pass.txt","refsource":"MISC","url":"http://www.modzero.ch/advisories/MZ-13-04-Blackberry_Z10-File-Exchange-Authentication-By-Pass.txt"},{"name":"20140812 BlackBerry Z 10 - Storage and Access File-Exchange Authentication By-Pass [MZ-13-04]","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/533118/100/0/threaded"}]}},"nvd":{"publishedDate":"2014-08-18 11:15:00","lastModifiedDate":"2018-10-09 19:43:00","problem_types":["CWE-264"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:A/AC:L/Au:N/C:C/I:N/A:N","accessVector":"ADJACENT_NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.1},"severity":"MEDIUM","exploitabilityScore":6.5,"impactScore":6.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:blackberry:blackberry_os:*:*:*:*:*:*:*:*","versionEndIncluding":"10.1.0.2354","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:h:blackberry:q10:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:h:blackberry:q5:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:h:blackberry:z10:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:h:blackberry:z30:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]}]}},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"2388","Ordinal":"69278","Title":"CVE-2014-2388","CVE":"CVE-2014-2388","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"2388","Ordinal":"1","NoteData":"The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for SMB filesystem access, which allows context-dependent attackers to read arbitrary files via (1) a session over a Wi-Fi network or (2) a session over a USB connection in Development Mode.","Type":"Description","Title":null},{"CveYear":"2014","CveId":"2388","Ordinal":"2","NoteData":"2014-08-18","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"2388","Ordinal":"3","NoteData":"2018-10-09","Type":"Other","Title":"Modified"}]}}}