CVE-2020-7364

UCWeb UC Browser Address Bar Spooofing

Medium4.3EPSS 0.74%

Published: 20 Oct 2020
Updated: 16 Sept 2024
Reserved: 21 Jan 2020
Assigned by: rapid7

Description

User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.

Scores

CVSS scores of CVE-2020-7364, by who scored it
Scored by	CVSS	Score	Vector
rapid7CNA (assigner)	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
NVDNVD · Modified	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS (exploitation in 30 days): 0.74% · top 45% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

CWE-451 User Interface (UI) Misrepresentation of Critical Information (opens in a new tab)All about CWE-451 and its CVEs

Affected products

UCWeb · UC Browser
- affected 13.0.8 – ≤ 13.0.8

References (2)

https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html (opens in a new tab)x_refsource_MISCx_transferred
https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/ (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-7364](https://trackcve.app/badge/CVE-2020-7364.svg)](https://trackcve.app/cve/CVE-2020-7364)

Record last updated 16 Sept 2024, 19:40 UTC.