CVE-2020-14120

{"id": "CVE-2020-14120", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-04-21T18:15:08.570", "references": [{"url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=145", "tags": ["Vendor Advisory"], "source": "security@xiaomi.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-354"}]}], "descriptions": [{"lang": "en", "value": "Some Xiaomi models have a vulnerability in a certain application. The vulnerability is caused by the lack of checksum when using a three-party application to pass in parameters, and attackers can induce users to install a malicious app and use the vulnerability to achieve elevated privileges, making the normal services of the system affected."}, {"lang": "es", "value": "Algunos modelos de Xiaomi presentan una vulnerabilidad en una aplicaci\u00f3n determinada. La vulnerabilidad est\u00e1 causada por una falta de suma de comprobaci\u00f3n cuando es usada una aplicaci\u00f3n tripartita para pasar par\u00e1metros, y los atacantes pueden inducir a usuarios a instalar una aplicaci\u00f3n maliciosa y usar la vulnerabilidad para conseguir altos privilegios, haciendo que los servicios normales del sistema est\u00e9n afectados"}], "lastModified": "2022-05-03T16:06:20.257", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:mi:miui:12.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7201F16F-F25C-4DC9-A1E8-53211931F011"}], "operator": "OR"}]}], "sourceIdentifier": "security@xiaomi.com"}