Search criteria

3 vulnerabilities found for xiaomi_cloud by mi

FKIE_CVE-2023-26316

Vulnerability from fkie_nvd - Published: 2023-08-02 14:15 - Updated: 2024-11-21 07:51
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies.
References
security@xiaomi.comhttps://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322Vendor Advisory
Impacted products
Vendor Product Version
mi xiaomi_cloud *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mi:xiaomi_cloud:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C7D2098-3042-4567-AA5D-C680BC72252C",
              "versionEndIncluding": "1.12.0.0.25",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview\u0027s whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account\u0027s cookies."
    }
  ],
  "id": "CVE-2023-26316",
  "lastModified": "2024-11-21T07:51:06.657",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-08-02T14:15:10.343",
  "references": [
    {
      "source": "security@xiaomi.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322"
    }
  ],
  "sourceIdentifier": "security@xiaomi.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2023-26316 (GCVE-0-2023-26316)

Vulnerability from cvelistv5 – Published: 2023-08-02 00:00 – Updated: 2024-09-27 21:58
VLAI?
Summary
A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies.
Severity ?
No CVSS data available.
CWE
  • XSS
Assigner
References
Impacted products
Vendor Product Version
n/a Xiaomi cloud service Application Affected: Xiaomi cloud service Application < 1.12.0.0.25
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:46:24.361Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-26316",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-27T21:50:09.403135Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-27T21:58:10.819Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xiaomi cloud service Application",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Xiaomi cloud service Application \u003c 1.12.0.0.25"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview\u0027s whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account\u0027s cookies."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "XSS",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-02T00:00:00",
        "orgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
        "shortName": "Xiaomi"
      },
      "references": [
        {
          "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
    "assignerShortName": "Xiaomi",
    "cveId": "CVE-2023-26316",
    "datePublished": "2023-08-02T00:00:00",
    "dateReserved": "2023-02-22T00:00:00",
    "dateUpdated": "2024-09-27T21:58:10.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26316 (GCVE-0-2023-26316)

Vulnerability from nvd – Published: 2023-08-02 00:00 – Updated: 2024-09-27 21:58
VLAI?
Summary
A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies.
Severity ?
No CVSS data available.
CWE
  • XSS
Assigner
References
Impacted products
Vendor Product Version
n/a Xiaomi cloud service Application Affected: Xiaomi cloud service Application < 1.12.0.0.25
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:46:24.361Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-26316",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-27T21:50:09.403135Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-27T21:58:10.819Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xiaomi cloud service Application",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Xiaomi cloud service Application \u003c 1.12.0.0.25"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview\u0027s whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account\u0027s cookies."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "XSS",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-02T00:00:00",
        "orgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
        "shortName": "Xiaomi"
      },
      "references": [
        {
          "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
    "assignerShortName": "Xiaomi",
    "cveId": "CVE-2023-26316",
    "datePublished": "2023-08-02T00:00:00",
    "dateReserved": "2023-02-22T00:00:00",
    "dateUpdated": "2024-09-27T21:58:10.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}