PT-2020-13201 · Opera+4 · Opera+4

Published 2020-05-08 · Updated 2024-08-04 · CVE-2020-12680

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Avira Free Antivirus versions 15.0.2005.1866 and earlier

Description The issue allows local users to discover user credentials. The functions of the executable file Avira.PWM.NativeMessaging.exe are aimed at collecting credentials stored in Chrome, Firefox, Opera, and Edge. The executable does not verify the calling program, thus a request such as fetchChromePasswords or fetchCredentials will succeed.

Recommendations For Avira Free Antivirus versions 15.0.2005.1866 and earlier, as a temporary workaround, consider disabling the Avira.PWM.NativeMessaging.exe executable until a patch is available. Restrict access to the fetchChromePasswords and fetchCredentials requests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2020-12680

Affected Products

Avira Free Antivirus

Google Chrome

Edge

Firefox

Opera

References · 6

• https://osv.dev/vulnerability/CVE-2020-12680 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12680 · Security Note
• https://t.me/cvenotify/3672 · Telegram Post
• https://medium.com/%40knikolenko/avira-free-antivirus-password-collector-83452fa7f943 · Note
• https://t.me/cvenotify/88970 · Telegram Post
• https://twitter.com/taviso/status/1258448515912491026 · Note