PT-2022-7914 · Ucweb · Uc Browser

X Ksi · Published 2022-06-13 · Updated 2022-06-22 · CVE-2017-20041

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ucweb UC Browser version 11.2.5.932

Description A critical issue has been found in the HTML Handler component, where the manipulation of the title argument leads to improper restriction of rendered UI layers via a URL. This can be exploited remotely. The issue has been publicly disclosed and may be used for attacks.

Recommendations For Ucweb UC Browser version 11.2.5.932, consider restricting access to the HTML Handler component until a patch is available. As a temporary workaround, avoid using the title argument in URLs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2017-20041

Affected Products

Uc Browser

References · 5

• 🔥 http://seclists.org/fulldisclosure/2017/Mar/36 · Exploit
• 🔥 https://vuldb.com/?id.98214 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-20041 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20041 · Vendor Advisory
• https://t.me/cibsecurity/44244 · Telegram Post