CVE-2018-20523

medium · 5.3

Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query content://com.android.browser.searchhistory/searchhistory request.

5.3

CVSS

10.0%

EPSS (exploit prob.)

95th

EPSS percentile

2019-06-07

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-77

Affected products

Vendor	Product	Affected versions
mi	stock_browser	10.2.4g
mi	redmi_7_firmware	all versions
mi	redmi_7	all versions
mi	redmi_note_7_firmware	all versions
mi	redmi_note_7	all versions
mi	redmi_note_6_pro_firmware	all versions
mi	redmi_note_6_pro	all versions
mi	redmi_6_firmware	all versions
mi	redmi_6	all versions
mi	redmi_6a_firmware	all versions
mi	redmi_6a	all versions
mi	redmi_s2_firmware	all versions
mi	redmi_s2	all versions
mi	redmi_note_5_pro_firmware	all versions
mi	redmi_note_5_pro	all versions
mi	redmi_k20_pro_firmware	all versions
mi	redmi_k20_pro	all versions
mi	redmi_k20_firmware	all versions
mi	redmi_k20	all versions
mi	redmi_7a_firmware	all versions
mi	redmi_7a	all versions
mi	redmi_go_firmware	all versions
mi	redmi_go	all versions
mi	redmi_note_5_firmware	all versions
mi	redmi_note_5	all versions
mi	redmi_y3_firmware	all versions
mi	redmi_y3	all versions
mi	redmi_note_7s_firmware	all versions
mi	redmi_note_7s	all versions
mi	redmi_s2_firmware	all versions
mi	redmi_s2	all versions
mi	redmi_4a_firmware	all versions
mi	redmi_4a	all versions
mi	redmi_note_4_firmware	all versions
mi	redmi_note_4	all versions
mi	redmi_5_plus_firmware	all versions
mi	redmi_5_plus	all versions
mi	redmi_note_5a_prime_firmware	all versions
mi	redmi_note_5a_prime	all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-20523