PT-2020-12499 · Moonlight · Moonlight

Cgutman · Published 2020-04-29 · Updated 2021-10-26 · CVE-2020-11024

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Moonlight iOS/tvOS versions prior to 4.0.1

Description The pairing process in Moonlight is susceptible to a man-in-the-middle attack, allowing an attacker to intercept and manipulate data. This issue has been resolved in version 4.0.1 for iOS and tvOS.

Recommendations For Moonlight iOS/tvOS versions prior to 4.0.1, update to version 4.0.1 to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-300

CWE-200

Related Identifiers

CVE-2020-11024

GHSA-G298-GP8Q-H6J3

Affected Products

Moonlight

References · 5

• https://github.com/moonlight-stream/moonlight-ios/commit/b0149b2fe9125a77ee11fe133382673694b6e8cc · Patch
• https://github.com/moonlight-stream/moonlight-ios/pull/405 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-11024 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11024 · Vendor Advisory
• https://github.com/moonlight-stream/moonlight-ios/security/advisories/GHSA-g298-gp8q-h6j3 · Note