CVE-2018-20523

EPSS 10.0%

Vexday Risk Score

28Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 10.0%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

07 Jun 2019Published on NVD

10 Aug 2021Public PoC

Weaponization speed

794 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query content://com.android.browser.searchhistory/searchhistory request.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/163796/Xiaomi-10.2.4.g-Information-Disclosure.htmlunverified exploitdbwww.exploit-db.com/exploits/50188unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/163796/Xiaomi-10.2.4.g-Information-Disclosure.html https://sec.xiaomi.com https://vishwarajbhattrai.wordpress.com/2019/03/22/content-provider-injection-in-xiaomi-stock-browser