PT-2021-9699 · Xiaomi · Xiaomi Community App

Published 2021-09-16 · Updated 2021-09-27 · CVE-2020-14130

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xiaomi community app versions prior to 3.0.210809

Description The issue concerns exposed JavaScript interfaces in the Xiaomi community, allowing sensitive functions to be maliciously called within the Xiaomi community app.

Recommendations For versions prior to 3.0.210809, update to a version 3.0.210809 or later to resolve the issue.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2020-14130

Affected Products

Xiaomi Community App

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-14130 · Security Note
• https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25&locale=zh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14130 · Vendor Advisory
• https://t.me/cibsecurity/28980 · Telegram Post