PT-2020-13864 · Viber · Viber For Windows

Published 2020-06-22 · Updated 2021-07-21 · CVE-2020-14049

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Viber for Windows versions up to 13.2.0.39

Description The issue arises from Viber for Windows not properly quoting its custom URI handler, allowing a malicious website to launch Viber with arbitrary parameters. This could force a victim to send an NTLM authentication request, which could then be relayed or have its hash captured for offline password cracking.

Recommendations For versions up to 13.2.0.39, update to a version that properly quotes its custom URI handler to prevent malicious exploitation.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2020-14049

Affected Products

Viber For Windows

References · 5

• 🔥 https://jeffs.sh/CVEs/CVE-2020-14049.txt · Exploit
• https://viber.com/en/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14049 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14049 · Vendor Advisory
• https://t.me/cvenotify/4584 · Telegram Post