Vulnerability-Lookup

CVE-2020-14129 (GCVE-0-2020-14129)

Vulnerability from cvelistv5 – Published: 2022-10-11 00:00 – Updated: 2024-08-04 12:39

Summary

A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege.

Severity ?

No CVSS data available.

CWE

Vulnerability logic vulnerability

Assigner

Xiaomi

References

URL

	Vendor	Product	Version
	n/a	Xiaomi a certain APP	Affected: Affected Version:3.4.5.18 Fixed Version:3.4.5.24

FKIE_CVE-2020-14129

Vulnerability from fkie_nvd - Published: 2022-10-11 20:15 - Updated: 2024-11-21 05:02

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege.

References

	URL	Tags
	security@xiaomi.com	https://trust.mi.com/misrc/bulletins/advisory?cveId=155	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://trust.mi.com/misrc/bulletins/advisory?cveId=155	Vendor Advisory

Impacted products

	Vendor	Product	Version
	mi	xiaomi	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mi:xiaomi:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F9C6762-9C78-47DC-9306-59762DE70629",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad l\u00f3gica en un producto de Xiaomi. La vulnerabilidad est\u00e1 causada por un fallo de verificaci\u00f3n de identidad, que puede ser explotado por un atacante que puede obtener una breve elevaci\u00f3n de privilegios"
    }
  ],
  "id": "CVE-2020-14129",
  "lastModified": "2024-11-21T05:02:43.457",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-10-11T20:15:10.267",
  "references": [
    {
      "source": "security@xiaomi.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://trust.mi.com/misrc/bulletins/advisory?cveId=155"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://trust.mi.com/misrc/bulletins/advisory?cveId=155"
    }
  ],
  "sourceIdentifier": "security@xiaomi.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GSD-2020-14129

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege.

Aliases

CVE-2020-14129

Aliases

CVE-2020-14129

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-14129",
    "id": "GSD-2020-14129"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-14129"
      ],
      "details": "A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege.",
      "id": "GSD-2020-14129",
      "modified": "2023-12-13T01:22:00.347370Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@xiaomi.com",
        "ID": "CVE-2020-14129",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Xiaomi a certain APP",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Affected Version:3.4.5.18 Fixed Version:3.4.5.24"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Vulnerability logic vulnerability"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://trust.mi.com/misrc/bulletins/advisory?cveId=155",
            "refsource": "MISC",
            "url": "https://trust.mi.com/misrc/bulletins/advisory?cveId=155"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mi:xiaomi:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@xiaomi.com",
          "ID": "CVE-2020-14129"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://trust.mi.com/misrc/bulletins/advisory?cveId=155",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://trust.mi.com/misrc/bulletins/advisory?cveId=155"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-10-13T13:18Z",
      "publishedDate": "2022-10-11T20:15Z"
    }
  }
}

GHSA-C735-HF6C-2X9J

Vulnerability from github – Published: 2022-10-12 12:00 – Updated: 2022-10-13 19:00

Details

A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-14129"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-11T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege.",
  "id": "GHSA-c735-hf6c-2x9j",
  "modified": "2022-10-13T19:00:22Z",
  "published": "2022-10-12T12:00:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14129"
    },
    {
      "type": "WEB",
      "url": "https://trust.mi.com/misrc/bulletins/advisory?cveId=155"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2020-14129 (GCVE-0-2020-14129)

FKIE_CVE-2020-14129

GSD-2020-14129

GHSA-C735-HF6C-2X9J

Tags

Sightings

Nomenclature