HIGH🇵🇱 Wersja polska

CVE-2019-13322

CVSS 8.8v3.1pub. 2020-02-10upd. 2024-11-21

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prior to 10.4.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the miui.share application. The issue results from the lack of proper validation of user-supplied data, which can result in an arbitrary application download. An attacker can leverage this vulnerability to execute code in the context of the user. Was ZDI-CAN-7483.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Mi Browser

    APP
    Mi
    < 10.4.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2020-14116HIGH7.5same product

An intent redirection vulnerability in the Mi Browser product. This vulnerability is caused by the Mi Browser ...

CVE-2019-13321HIGH8.0same product

This vulnerability allows network adjacent attackers to execute arbitrary code on affected installations of Xi...

CVE-2019-10875MEDIUM6.5same product

A URL spoofing vulnerability was found in all international versions of Xiaomi Mi browser 10.5.6-g (aka the MI...

CVE-2024-4405CRITICAL9.6PL ✓same vendor

XSS umożliwiający RCE w Xiaomi 13 Pro — plik manual-upgrade.html

CVE-2024-4406CRITICAL9.6PL ✓same vendor

XSS umożliwiający RCE w aplikacji GetApps na Xiaomi 13 Pro