CVE-2020-36473: Medium severity ucweb uc browser vulnerability
Published Aug 14, 2021
·Updated
UCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HTTP, and thus man-in-the-middle attackers can discover visited URLs.
Affected Software
1 affected component
UCWeb UCWeb UC>=12.12.3.1219<=12.12.3.1226
Event History
Aug 14, 2021
CVE Published
via MITRE·08:49 PM
Data Sourced
via MITRE·08:49 PM
Description
Frequently Asked Questions
1
Who is exposed to this issue?
Users of UCWeb UC versions 12.12.3.1219 through 12.12.3.1226 are exposed when their browsing traffic can be observed or intercepted by a man-in-the-middle attacker.
2
What does an attacker need to exploit it?
The attacker must be positioned to perform a network man-in-the-middle attack. No privileges or user interaction are required, but the CVSS vector rates attack complexity as high.
3
What information can be exposed?
An attacker can discover URLs visited through the affected software. The provided data does not indicate exposure of page contents, credentials, or modification of traffic.