A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies.
References
| Link | Resource |
|---|---|
| https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322 | Vendor Advisory |
| https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322 | Vendor Advisory |
Configurations
History
21 Nov 2024, 07:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322 - Vendor Advisory |
07 Aug 2023, 18:01
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CPE | cpe:2.3:a:mi:xiaomi_cloud:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| References | (MISC) https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322 - Vendor Advisory |
02 Aug 2023, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-02 14:15
Updated : 2024-11-21 07:51
NVD link : CVE-2023-26316
Mitre link : CVE-2023-26316
CVE.ORG link : CVE-2023-26316
JSON object : View
Products Affected
mi
- xiaomi_cloud
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')