CVE-2020-7364

User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/	Exploit Mitigation Third Party Advisory
https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ucweb:uc_browser:*:*:*:*:*:android:*:*

History

No history.

Information

Published : 2020-10-20 17:15

Updated : 2023-12-10 13:41

NVD link : CVE-2020-7364

Mitre link : CVE-2020-7364

CVE.ORG link : CVE-2020-7364

JSON object : View

Products Affected

ucweb

uc_browser

CWE

NVD-CWE-Other CWE-451

User Interface (UI) Misrepresentation of Critical Information

{"id": "CVE-2020-7364", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cve@rapid7.con", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2020-10-20T17:15:13.247", "references": [{"url": "https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@rapid7.con"}, {"url": "https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@rapid7.con"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "cve@rapid7.con", "description": [{"lang": "en", "value": "CWE-451"}]}], "descriptions": [{"lang": "en", "value": "User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions."}, {"lang": "es", "value": "Una vulnerabilidad de Representaci\u00f3n Inapropiada de la Interfaz de Usuario (UI) de una Informaci\u00f3n Cr\u00edtica en la barra de direcciones del UC Browser de UCWeb permite a un atacante ofuscar la verdadera fuente de datos tal como se presentaba en el navegador. Este problema afecta UC Browser de UCWeb versi\u00f3n 13.0.8 y versiones anteriores"}], "lastModified": "2020-10-28T19:09:43.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ucweb:uc_browser:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "F06258AF-67B4-44F8-A179-270FEE8C6CE7", "versionEndExcluding": "13.3.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@rapid7.con"}