PT-2020-4724 · Yandex · Yandex Browser

Rafay Baloch · Published 2020-08-10 · Updated 2020-10-21 · CVE-2020-7369

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Yandex Browser versions prior to 20.8.4

Description: The issue is related to the misrepresentation of critical information in the address bar of the Yandex Browser, allowing an attacker to obfuscate the true source of data as presented in the browser. This can be exploited to conduct spoofing attacks.

Recommendations: For versions prior to 20.8.4, update to version 20.8.4 or later to resolve the issue.

Exploit

Fix

Missing Authentication

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-306

CWE-451

Related Identifiers

BDU:2020-05276

CVE-2020-7369

Affected Products

Yandex Browser

References · 7

• 🔥 https://rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html · Exploit
• 🔥 https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities · Exploit
• https://bdu.fstec.ru/vul/2020-05276 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-7369 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7369 · Vendor Advisory
• https://securitylab.ru/news/513265.php · Note
• https://yandex.ru/support/browser-mobile-android-phone/install/install.html · Note