ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2018-20523

PoC ×2—
CVSS 3.1
5.3 medium
EPSS
10%p95
Published
()
Modified
Description

Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query content://com.android.browser.searchhistory/searchhistory request.

Vendors
mi
Products
stock browser, redmi 7 firmware, redmi note 7 firmware, redmi note 6 pro firmware, redmi 6 firmware, redmi 6a firmware, redmi s2 firmware, redmi note 5 pro firmware, redmi k20 pro firmware, redmi k20 firmware, redmi 7a firmware, redmi go firmware
Weakness
CWE-77
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD CVE.org GitHub PoCs EPSS (10.0%)

In the news

No ingested article mentions this CVE yet.