CVE-2020-7369: Yandex Browser Address Bar Spooofing
Vulnerability summary
CVE-2020-7369 is a medium (CVSS 4.3) vulnerability in yandex yandex_browser. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 62.2% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 20-10-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Yandex Browser version 20.8.3 and prior versions, and was fixed in version 20.8.4 released October 1, 2020.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.99%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.99% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (rafaybaloch.com)
Maturity: unknown
Exploit Reference (blog.rapid7.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-451User Interface (UI) Misrepresentation of Critical InformationThe user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Yandex1 product
- yandex_browser20.8.3 | < 20.8.4
1 vendor · 1 product
References
2 links- www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.htmlX Refsource MISCExploitThird Party Advisory
- blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/X Refsource MISCExploitMitigationThird Party Advisory