PT-2020-19762 · Mintegral · Mintegraladsdk

Alyssa Miller + 1 · Published 2020-10-19 · Updated 2020-10-21 · CVE-2020-7745

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MintegralAdSDK versions prior to 6.6.0.0

Description The issue concerns malicious functionality within the SDK that acts as a backdoor, allowing Mintegral and its partners to remotely execute arbitrary code on a user's device. This enables them to perform unauthorized actions on the device.

Recommendations For versions prior to 6.6.0.0, update to version 6.6.0.0 or later to resolve the issue. As a temporary workaround, consider restricting or disabling the use of the MintegralAdSDK until the update can be applied.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-7745

SNYK-COCOAPODS-MINTEGRALADSDK-1019377

Affected Products

Mintegraladsdk

References · 7

• 🔥 https://youtube.com/watch?v=n-mEMkeoUqs · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7745 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7745 · Vendor Advisory
• https://snyk.io/blog/remote-code-execution-rce-sourmint · Note
• https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-1019377 · Note
• https://t.me/cibsecurity/15362 · Telegram Post
• https://snyk.io/research/sour-mint-malicious-sdk/%23rce · Note