PT-2020-19761 · Mintegral · Com.Mintegral.Msdk

Alyssa Miller + 1 · Published 2020-10-15 · Updated 2021-04-22 · CVE-2020-7744

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions com.mintegral.msdk:alphab (affected versions not specified)

Description The Android SDK contains malicious functionality that tracks downloads from Google URLs, including file downloads, e-mail attachments, and Google Docs links, as well as all APK downloads. The module listens to download events in Android's download manager and detects if the downloaded file's URL contains google.com or comes from a Google app, or ends with .apk for APK downloads. The captured data is sent back to Mintegral's servers. This functionality runs even when the app is not in focus, i.e., in the background.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-7744

GHSA-C6P9-24RC-JR5H

SNYK-JAVA-COMMINTEGRALMSDK-1018714

Affected Products

Com.Mintegral.Msdk

References · 7

• https://osv.dev/vulnerability/CVE-2020-7744 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7744 · Security Note
• https://osv.dev/vulnerability/GHSA-c6p9-24rc-jr5h · Vendor Advisory
• https://snyk.io/research/sour-mint-malicious-sdk · Note
• https://t.me/cibsecurity/15290 · Telegram Post
• https://snyk.io/blog/remote-code-execution-rce-sourmint · Note
• https://snyk.io/vuln/SNYK-JAVA-COMMINTEGRALMSDK-1018714 · Note