Lucene search

PRIOn knowledge basePRION:CVE-2023-26316

HistoryAug 02, 2023 - 2:15 p.m.

Cross site scripting

2023-08-0214:15:00

PRIOn knowledge base

www.prio-n.com

xss

vulnerability

xiaomi

cloud service

webview

whitelist

javascript

protocol

exploit

nvd

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.6%

JSON

A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview’s whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account’s cookies.

CPENameOperatorVersion
xiaomi_cloudle1.12.0.0.25

CPE	Name	Operator	Version
	xiaomi_cloud	le	1.12.0.0.25

References

trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322