CVE-2020-7371

User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the RITS Browser version 3.3.9 and prior versions.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/	Exploit Mitigation Third Party Advisory
https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:raiseitsolutions:rits_browser:*:*:*:*:*:android:*:*

History

No history.

Information

Published : 2020-10-20 17:15

Updated : 2023-12-10 13:41

NVD link : CVE-2020-7371

Mitre link : CVE-2020-7371

CVE.ORG link : CVE-2020-7371

JSON object : View

Products Affected

raiseitsolutions

rits_browser

CWE

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

CWE-451

User Interface (UI) Misrepresentation of Critical Information

{"id": "CVE-2020-7371", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cve@rapid7.con", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2020-10-20T17:15:13.513", "references": [{"url": "https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@rapid7.con"}, {"url": "https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@rapid7.con"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1021"}]}, {"type": "Secondary", "source": "cve@rapid7.con", "description": [{"lang": "en", "value": "CWE-451"}]}], "descriptions": [{"lang": "en", "value": "User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the RITS Browser version 3.3.9 and prior versions."}, {"lang": "es", "value": "Una vulnerabilidad de Representaci\u00f3n Inapropiada de la Interfaz de Usuario (UI) de una Informaci\u00f3n Cr\u00edtica en la barra de direcciones del Yandex Browser permite a un atacante ocultar la verdadera fuente de datos tal como se presentaba en el navegador. Este problema afecta a RITS Browser versi\u00f3n 3.3.9 y versiones anteriores"}], "lastModified": "2020-10-29T19:11:20.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:raiseitsolutions:rits_browser:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "6125F8A1-9AFE-4E5E-ADA6-DDE936028BB2", "versionEndIncluding": "3.3.9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@rapid7.con"}