CVE-2023-26322

A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://trust.mi.com/misrc/bulletins/advisory?cveId=542	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mi:getapps:*:*:*:*:*:*:*:*

History

12 Sep 2024, 17:27

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo

12 Sep 2024, 17:18

Type	Values Removed	Values Added
References	~~() https://trust.mi.com/misrc/bulletins/advisory?cveId=542 -~~	() https://trust.mi.com/misrc/bulletins/advisory?cveId=542 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~8.8~~	v2 : unknown v3 : 9.8
First Time		Mi Mi getapps
CPE		cpe:2.3:a:mi:getapps::::::::

28 Aug 2024, 14:35

Type	Values Removed	Values Added
CWE		CWE-94

28 Aug 2024, 12:57

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de ejecución de código en el producto de aplicación XiaomiGetApps. Esta vulnerabilidad se debe a que se omite la lógica de verificación y un atacante puede aprovechar esta vulnerabilidad para ejecutar código malicioso.

28 Aug 2024, 08:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-28 08:15

Updated : 2024-09-12 17:27

NVD link : CVE-2023-26322

Mitre link : CVE-2023-26322

CVE.ORG link : CVE-2023-26322

JSON object : View

Products Affected

mi

getapps

CWE

NVD-CWE-noinfo CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2023-26322", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security@xiaomi.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-08-28T08:15:06.263", "references": [{"url": "https://trust.mi.com/misrc/bulletins/advisory?cveId=542", "tags": ["Vendor Advisory"], "source": "security@xiaomi.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code."}, {"lang": "es", "value": "Existe una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo en el producto de aplicaci\u00f3n XiaomiGetApps. Esta vulnerabilidad se debe a que se omite la l\u00f3gica de verificaci\u00f3n y un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo malicioso."}], "lastModified": "2024-09-12T17:27:10.637", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mi:getapps:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9765252A-895A-406A-A53D-4D64628F30F4", "versionEndExcluding": "32.0.0.1", "versionStartIncluding": "31.2.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@xiaomi.com"}