CVE Feed

    Dashboard / CVE / CVE-2018-20523

    CVE-2018-20523

    Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query content://com.android.browser.searchhistory/searchhistory request.

    Published:Jun 7, 2019
    Last Modified:Nov 21, 2024
    EPS:Jun 7, 2019
    EPSS Score:0.06192
    CVSS Score:5.3

    Affected Products

    Vendor
    Mi
    Product
    Redmi 4a
    Vendor
    Mi
    Product
    Redmi 4a Firmware
    Vendor
    Mi
    Product
    Redmi 5 Plus
    Vendor
    Mi
    Product
    Redmi 5 Plus Firmware
    Vendor
    Mi
    Product
    Redmi 6
    Vendor
    Mi
    Product
    Redmi 6 Firmware
    Vendor
    Mi
    Product
    Redmi 6a
    Vendor
    Mi
    Product
    Redmi 6a Firmware
    Vendor
    Mi
    Product
    Redmi 7
    Vendor
    Mi
    Product
    Redmi 7 Firmware
    Vendor
    Mi
    Product
    Redmi 7a
    Vendor
    Mi
    Product
    Redmi 7a Firmware
    Vendor
    Mi
    Product
    Redmi Go
    Vendor
    Mi
    Product
    Redmi Go Firmware
    Vendor
    Mi
    Product
    Redmi K20
    Vendor
    Mi
    Product
    Redmi K20 Firmware
    Vendor
    Mi
    Product
    Redmi K20 Pro
    Vendor
    Mi
    Product
    Redmi K20 Pro Firmware
    Vendor
    Mi
    Product
    Redmi Note 4
    Vendor
    Mi
    Product
    Redmi Note 4 Firmware
    Vendor
    Mi
    Product
    Redmi Note 5
    Vendor
    Mi
    Product
    Redmi Note 5 Firmware
    Vendor
    Mi
    Product
    Redmi Note 5 Pro
    Vendor
    Mi
    Product
    Redmi Note 5 Pro Firmware
    Vendor
    Mi
    Product
    Redmi Note 5a Prime
    Vendor
    Mi
    Product
    Redmi Note 5a Prime Firmware
    Vendor
    Mi
    Product
    Redmi Note 6 Pro
    Vendor
    Mi
    Product
    Redmi Note 6 Pro Firmware
    Vendor
    Mi
    Product
    Redmi Note 7
    Vendor
    Mi
    Product
    Redmi Note 7 Firmware
    Vendor
    Mi
    Product
    Redmi Note 7s
    Vendor
    Mi
    Product
    Redmi Note 7s Firmware
    Vendor
    Mi
    Product
    Redmi S2
    Vendor
    Mi
    Product
    Redmi S2 Firmware
    Vendor
    Mi
    Product
    Redmi Y3
    Vendor
    Mi
    Product
    Redmi Y3 Firmware
    Vendor
    Mi
    Product
    Stock Browser

    Exploits

    http://packetstormsecurity.com/files/163796/Xiaomi-10.2.4.g-Information-Disclosure.htmlhttps://vishwarajbhattrai.wordpress.com/2019/03/22/content-provider-injection-in-xiaomi-stock-browserhttp://packetstormsecurity.com/files/163796/Xiaomi-10.2.4.g-Information-Disclosure.htmlhttps://vishwarajbhattrai.wordpress.com/2019/03/22/content-provider-injection-in-xiaomi-stock-browserhttps://www.exploit-db.com/exploits/50188

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High