CVE-2020-14130 Missing authorization in Xiaomi community app
Exposed JavaScript interfaces in the Xiaomi community app allow attackers to maliciously call sensitive functions, potentially leading to unauthorized access or data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-14130?
CVE-2020-14130 is a medium-severity missing authorization vulnerability in Xiaomi community app, published on 16 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Some js interfaces in the Xiaomi community were exposed, causing sensitive functions to be maliciously called on Xiaomi community app Affected Version <3.0.210809
Weakness: CWE-668
Which versions are affected by CVE-2020-14130?
It affects 1 product.
Products include Mi Xiaomi.
How do I fix CVE-2020-14130?
No fix has been published for CVE-2020-14130 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-14130 being exploited?
There is no known exploitation of CVE-2020-14130 in the wild and no public exploit code.
Other vulnerabilities in Xiaomi community app
Sources
Also known as GHSA-6cpv-gpjr-7h64.