PT-2022-8553 · Xiaomi · Mi App Store

Published 2022-04-21 · Updated 2022-05-03 · CVE-2020-14118

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mi App Store (affected versions not specified)

Description The issue is caused by the Mi App Store not verifying the validity of incoming data, which can lead to the app store automatically downloading and installing apps. This is due to an intent redirection vulnerability in the Mi App Store product.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-14118

Affected Products

Mi App Store

References · 5

• https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=144 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14118 · Security Note
• https://t.me/cibsecurity/41252 · Telegram Post
• https://t.me/cvenotify/29639 · Telegram Post