HIGH🇵🇱 Wersja polska

CVE-2019-13322

CVSS 8.8v3.1pub. 2020-02-10upd. 2024-11-21

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prior to 10.4.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the miui.share application. The issue results from the lack of proper validation of user-supplied data, which can result in an arbitrary application download. An attacker can leverage this vulnerability to execute code in the context of the user. Was ZDI-CAN-7483.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Mi Browser

    APP
    Mi
    < 10.4.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2020-14116HIGH7.5ten sam produkt

An intent redirection vulnerability in the Mi Browser product. This vulnerability is caused by the Mi Browser ...

CVE-2019-13321HIGH8.0ten sam produkt

This vulnerability allows network adjacent attackers to execute arbitrary code on affected installations of Xi...

CVE-2019-10875MEDIUM6.5ten sam produkt

A URL spoofing vulnerability was found in all international versions of Xiaomi Mi browser 10.5.6-g (aka the MI...

CVE-2024-4405CRITICAL9.6PL ✓ten sam vendor

XSS umożliwiający RCE w Xiaomi 13 Pro — plik manual-upgrade.html

CVE-2024-4406CRITICAL9.6PL ✓ten sam vendor

XSS umożliwiający RCE w aplikacji GetApps na Xiaomi 13 Pro