PT-2020-20720 · Xiaomi · Getapps+1

Fluoroacetate · Published 2020-03-06 · Updated 2021-07-21 · CVE-2020-9530

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xiaomi MIUI versions prior to 11.0.1.54 GetApps(com.xiaomi.mipicks) versions prior to 2001122

Description An issue was discovered in the export component of GetApps, which mishandles the functionality of opening other components. Attackers can induce users to open specific web pages in a specific network environment, leading to information leakage. This occurs when the WebView component of Messaging is loaded with malicious web pages.

Recommendations For Xiaomi MIUI versions prior to 11.0.1.54, update to version 11.0.1.54 or later to resolve the issue. For GetApps(com.xiaomi.mipicks) versions prior to 2001122, update to version 2001122 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebView component of Messaging to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-9530

ZDI-20-289

Affected Products

Getapps

Miui

References · 4

• https://zerodayinitiative.com/advisories/ZDI-20-289 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-9530 · Security Note
• https://sec.xiaomi.com/post/180 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9530 · Vendor Advisory