by Kastro
Paper/Archive/CVE-2023-26321

CVE-2023-26321

Xiaomi Xiaomi File Manager App International Version — The international version of Xiaomi File Manager has a path traversal vulnerability

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.0.460 × 209.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A path traversal vulnerability exists in the Xiaomi File Manager application product(international version). The vulnerability is caused by unfiltered special characters and can be exploited by attackers to overwrite and execute code in the file.

Affected

ProductAffectedFixed inSource
Xiaomi File Manager App International VersionXiaomi File Manager App International Version – V1-210567–CNA
file_manager≤ v1-210586–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Xiaomi (CNA)6.3CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reftrust.mi.com/misrc/bulletins/advisory?cveId=541