CVE-2020-14049: High severity viber vulnerability
Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary parameters, forcing a victim to send an NTLM authentication request, and either relay the request or capture the hash for offline password cracking. NOTE: this issue exists because of an incomplete fix for CVE-2019-12569.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-14049?
CVE-2020-14049 is a vulnerability in Viber for Windows up to version 13.2.0.39 that allows a malicious website to launch Viber with arbitrary parameters and potentially capture NTLM authentication requests for offline password cracking.
How does CVE-2020-14049 impact Viber for Windows?
CVE-2020-14049 allows an attacker to exploit Viber for Windows and potentially capture NTLM authentication requests.
Is there a fix available for CVE-2020-14049?
At the moment, there is no official fix available for CVE-2020-14049. It is recommended to keep Viber for Windows up to date and avoid clicking on suspicious links or visiting malicious websites.
What is the severity of CVE-2020-14049?
The severity of CVE-2020-14049 is high with a CVSS score of 7.5.
Where can I find more information about CVE-2020-14049?
You can find more information about CVE-2020-14049 on the official Viber website and the CVE-2020-14049.txt document.