PT-2019-13258 · Xiaomi · Xiaomi Browser
Georgi Geshev
+1
·
Published
2019-07-12
·
Updated
2020-02-11
·
CVE-2019-13322
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Xiaomi Browser versions prior to 10.4.0
Description
This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of the
miui.share application due to the lack of proper validation of user-supplied data, resulting in an arbitrary application download. An attacker can leverage this to execute code in the context of the user.Recommendations
For versions prior to 10.4.0, update to version 10.4.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
miui.share application until a patch is applied. Avoid opening malicious files or visiting untrusted websites to minimize the risk of exploitation.Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Xiaomi Browser