cnvd - cnvd-2020-52935

CNVD-2020-52935

Vulnerability from cnvd - Published: 2020-09-21

Title

Xiaomi MIUI信息泄露漏洞

Description

Xiaomi MIUI是中国小米科技（Xiaomi）公司的一套基于Android开发的智能手机操作系统。 Xiaomi MIUI 11.0.5.0.QFAEUXM版本中存在信息泄露漏洞。攻击者可借助NFC工具利用该漏洞安装应用程序，获取信息。

Severity

中

Patch Name

Xiaomi MIUI信息泄露漏洞的补丁

Patch Description

Xiaomi MIUI是中国小米科技（Xiaomi）公司的一套基于Android开发的智能手机操作系统。 Xiaomi MIUI 11.0.5.0.QFAEUXM版本中存在信息泄露漏洞。攻击者可借助NFC工具利用该漏洞安装应用程序，获取信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://sec.xiaomi.com/post/180

Reference

https://sec.xiaomi.com/post/180

Impacted products

Name
Xiaomi Xiaomi MIUI 11.0.5.0.QFAEUXM

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-9531",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-9531"
    }
  },
  "description": "Xiaomi MIUI\u662f\u4e2d\u56fd\u5c0f\u7c73\u79d1\u6280\uff08Xiaomi\uff09\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8eAndroid\u5f00\u53d1\u7684\u667a\u80fd\u624b\u673a\u64cd\u4f5c\u7cfb\u7edf\u3002\n\nXiaomi MIUI 11.0.5.0.QFAEUXM\u7248\u672c\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9NFC\u5de5\u5177\u5229\u7528\u8be5\u6f0f\u6d1e\u5b89\u88c5\u5e94\u7528\u7a0b\u5e8f\uff0c\u83b7\u53d6\u4fe1\u606f\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://sec.xiaomi.com/post/180",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-52935",
  "openTime": "2020-09-21",
  "patchDescription": "Xiaomi MIUI\u662f\u4e2d\u56fd\u5c0f\u7c73\u79d1\u6280\uff08Xiaomi\uff09\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8eAndroid\u5f00\u53d1\u7684\u667a\u80fd\u624b\u673a\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nXiaomi MIUI 11.0.5.0.QFAEUXM\u7248\u672c\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9NFC\u5de5\u5177\u5229\u7528\u8be5\u6f0f\u6d1e\u5b89\u88c5\u5e94\u7528\u7a0b\u5e8f\uff0c\u83b7\u53d6\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Xiaomi MIUI\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Xiaomi Xiaomi MIUI 11.0.5.0.QFAEUXM"
  },
  "referenceLink": "https://sec.xiaomi.com/post/180",
  "serverity": "\u4e2d",
  "submitTime": "2020-09-18",
  "title": "Xiaomi MIUI\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2020-9531 (GCVE-0-2020-9531)

Vulnerability from cvelistv5 – Published: 2020-03-06 16:49 – Updated: 2024-08-04 10:34

Summary

An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. In the Web resources of GetApps(com.xiaomi.mipicks), the parameters passed in are read and executed. After reading the resource files, relevant components open the link of the incoming URL. Although the URL is safe and can pass security detection, the data carried in the parameters are loaded and executed. An attacker can use NFC tools to get close enough to a user's unlocked phone to cause apps to be installed and information to be leaked. This is fixed on version: 2001122.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://sec.xiaomi.com/post/180	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-…	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:34:38.561Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sec.xiaomi.com/post/180"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-287/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-288/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. In the Web resources of GetApps(com.xiaomi.mipicks), the parameters passed in are read and executed. After reading the resource files, relevant components open the link of the incoming URL. Although the URL is safe and can pass security detection, the data carried in the parameters are loaded and executed. An attacker can use NFC tools to get close enough to a user\u0027s unlocked phone to cause apps to be installed and information to be leaked. This is fixed on version: 2001122."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-12T15:06:07",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sec.xiaomi.com/post/180"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-287/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-288/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-9531",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. In the Web resources of GetApps(com.xiaomi.mipicks), the parameters passed in are read and executed. After reading the resource files, relevant components open the link of the incoming URL. Although the URL is safe and can pass security detection, the data carried in the parameters are loaded and executed. An attacker can use NFC tools to get close enough to a user\u0027s unlocked phone to cause apps to be installed and information to be leaked. This is fixed on version: 2001122."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://sec.xiaomi.com/post/180",
              "refsource": "MISC",
              "url": "https://sec.xiaomi.com/post/180"
            },
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-20-287/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-287/"
            },
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-20-288/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-288/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-9531",
    "datePublished": "2020-03-06T16:49:42",
    "dateReserved": "2020-03-01T00:00:00",
    "dateUpdated": "2024-08-04T10:34:38.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-52935

CVE-2020-9531 (GCVE-0-2020-9531)

Tags

Sightings

Nomenclature