CVE-2019-11015
Last modified
CVE-2019-11015 is a vulnerability of currently unknown severity. A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the Wallpaper Carousel application to obtain sensitive Clipboard data and the user's stored credentials (partially). This occurs because of paste access to a social media login page.. EPSS estimates a 0.54% chance of exploitation in the next 30 days.
Description
A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the Wallpaper Carousel application to obtain sensitive Clipboard data and the user's stored credentials (partially). This occurs because of paste access to a social media login page.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Miui | Miui | 10.1.3.0 |
References
- https://www.andmp.com/2019/04/unpatched-vulnerability-in-xiaomi-miui-os-lock-screen.htmlExploit, Third Party Advisory
- https://www.andmp.com/2019/04/unpatched-vulnerability-in-xiaomi-miui-os-lock-screen.htmlExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-11015?
How severe is CVE-2019-11015?
How do I fix CVE-2019-11015?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-11009In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-…
- CVE-2019-1101An information disclosure vulnerability exists when the Wind…
- CVE-2019-11010In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memor…
- CVE-2019-11011Akamai CloudTest before 58.30 allows remote code execution.
- CVE-2019-11013Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory …
- CVE-2019-11014The VStarCam vstc.vscam.client library and vstc.vscam shared…
- CVE-2019-11016Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redi…
- CVE-2019-11017On D-Link DI-524 V2.06RU devices, multiple Stored and Reflec…4.8
- CVE-2019-11018application\admin\controller\User.php in ThinkAdmin V4.0 doe…
- CVE-2019-11019Lack of authentication in case-exporting components in DDRT …7.5
- CVE-2019-1102A remote code execution vulnerability exists in the way that…
- CVE-2019-11020Lack of authentication in file-viewing components in DDRT Da…7.5
Are you affected by CVE-2019-11015?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST