CVE-2020-14049

Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler

published June 22, 2020

CVSS
—
EPSS
2%
Percentile
82.1
In the wild
Unconfirmed
What it is

Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary parameters, forcing a victim to send an NTLM authentication request, and either relay the request or capture the hash for offline password cracking. NOTE: this issue exists because of an incomplete fix for CVE-2019-12569.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02161 · 82.1th percentile
Published
2020-06-22T17:27Z
EPSS history
Timeline
  • 22 JUN 17:27Z
    Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler
    cvelistv5