5.4med
CVE-2017-20041
Ucweb UC Browser HTML URL improper restriction of rendered ui layers
Published 4 y ago · modified 4 mo ago · JSON
CVSS
5.4
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 54%
Public exploits
0
none known
Summary
A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers (URL). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction (EPSS)
0.71% probability of exploitation in the next 30 days, higher than 54% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected products
- Ucweb UC Browser
Classification
- Weakness
- CWE-1021 Improper Restriction of Rendered UI Layers or Frames
References
- seclists.org /fulldisclosure/2017/Mar/36 · x_refsource_MISC, x_transferred
- vuldb.com /?id.98214 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-20041
- NVD: CVE-2017-20041
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.