PT-2020-19577 · Danyil Vasilenko · Boat Browser

Rafay Baloch · Published 2020-10-20 · Updated 2020-10-21 · CVE-2020-7370

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bolt Browser versions 1.4 and prior

Description The issue allows an attacker to obfuscate the true source of data as presented in the browser due to a User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser.

Recommendations For Bolt Browser versions 1.4 and prior, update to a version later than 1.4 to resolve the issue.

Exploit

Fix

Missing Authentication

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-306

CWE-451

Related Identifiers

CVE-2020-7370

Affected Products

Boat Browser

References · 5

• 🔥 https://rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html · Exploit
• 🔥 https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7370 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7370 · Vendor Advisory
• https://t.me/cibsecurity/15421 · Telegram Post