PT-2020-12727 · Mids · Mids' Reborn Hero Designer

Published 2020-06-11 · Updated 2021-07-21 · CVE-2020-11614

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mids' Reborn Hero Designer version 2.6.0.7

Description The issue concerns the application's update process, where it downloads update manifests and files over cleartext HTTP. Furthermore, the application lacks file integrity validation for downloaded files. This setup allows an attacker to perform a man-in-the-middle attack, replacing executable files with malicious versions. As a result, the operating system executes these malicious files under the context of the user running the application.

Recommendations For version 2.6.0.7, consider restricting the application's ability to download updates over cleartext HTTP until a secure update mechanism is implemented. As a temporary workaround, users should be cautious when updating the application and ensure they are using a trusted network connection to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-319

CWE-345

Related Identifiers

CVE-2020-11614

Affected Products

Mids' Reborn Hero Designer

References · 4

• 🔥 https://doyler.net/security-not-included/mids-reborn-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2020-11614 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11614 · Security Note
• ❌ https://github.com/Crytilis/mids-reborn-hero-designer/releases · Note, Deleted