{
  "GSD": {
    "alias": "CVE-2023-26316",
    "id": "GSD-2023-26316"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-26316"
      ],
      "details": "A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview\u0027s whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account\u0027s cookies.",
      "id": "GSD-2023-26316",
      "modified": "2023-12-13T01:20:53.734272Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@xiaomi.com",
        "ID": "CVE-2023-26316",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Xiaomi cloud service Application",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Xiaomi cloud service Application \u003c 1.12.0.0.25"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview\u0027s whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account\u0027s cookies."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "XSS"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322",
            "refsource": "MISC",
            "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mi:xiaomi_cloud:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.12.0.0.25",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@xiaomi.com",
          "ID": "CVE-2023-26316"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview\u0027s whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account\u0027s cookies."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2023-08-07T18:01Z",
      "publishedDate": "2023-08-02T14:15Z"
    }
  }
}