CVE Vulnerability

CVE-2020-7705

This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads.

5.8 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 4.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

Scope

8.1 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Third Party Advisory
https://snyk.io/research/sour-mint-malicious-sdk/ Third Party Advisory
https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:mintegral:mintegraladsdk:*:*:*:*:*:*:*:*
Information

Published : 2020-08-24 06:15

Updated : 2020-09-02 02:53

NVD link : CVE-2020-7705

Mitre link : CVE-2020-7705

Products Affected
No products.
CWE
CWE-1021

Improper Restriction of Rendered UI Layers or Frames