PT-2019-13258 · Xiaomi · Xiaomi Browser

Georgi Geshev + 1 · Publicado 2019-07-12 · Atualizado 2020-02-11 · CVE-2019-13322

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xiaomi Browser versions prior to 10.4.0

Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of the miui.share application due to the lack of proper validation of user-supplied data, resulting in an arbitrary application download. An attacker can leverage this to execute code in the context of the user.

Recommendations For versions prior to 10.4.0, update to version 10.4.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the miui.share application until a patch is applied. Avoid opening malicious files or visiting untrusted websites to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-356

Identificadores relacionados

CVE-2019-13322

ZDI-19-660

Produtos afetados

Xiaomi Browser

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-13322 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-13322 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-19-660 · Nota de Segurança