CVE-2019-10250: Medium severity ucweb ucmobile vulnerability
Published Mar 28, 2019
·Updated
UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks.
Affected Software
2 affected components
UCWeb UC Browser=7.0.185.1002
Microsoft Windows
Event History
Mar 28, 2019
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction, but must be able to perform a man-in-the-middle attack on the network connection used to download the affected PDF modules. The CVSS vector rates attack complexity as high.
2
What is the likely impact if exploitation succeeds?
The vulnerability can expose the confidentiality of the downloaded content or module, as reflected by the high confidentiality impact in the CVSS vector. No integrity or availability impact is specified.
3
How can I determine whether a system is affected?
The affected product and version identified in the available data are UCWeb UC Browser 7.0.185.1002 on Windows. The issue concerns downloads of certain PDF modules performed over HTTP.