PT-2020-20392 · Opensearch · Opensearch Web Browser

Published 2020-06-08 · Updated 2020-06-11 · CVE-2020-8954

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenSearch Web browser version 1.0.4.9

Description The issue allows Intent Scheme Hijacking, where a link that opens another app in the browser can be manipulated.

Recommendations For OpenSearch Web browser version 1.0.4.9, consider restricting the use of intent schemes to minimize the risk of exploitation until a patch is available.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-8954

Affected Products

Opensearch Web Browser

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-8954 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8954 · Vendor Advisory
• https://raw.githubusercontent.com/marcelbohland/OpenSerach-CVE-SVE-reference-/master/CVE-list · Note
• https://play.google.com/store/apps/details?id=de.marcel.opensearch&hl=en_US · Note