VulnerabilityModified

CVE-2020-15502

HIGH 7.5EPSS 1.53%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has stated "the favicon service adheres to our strict privacy policy.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 1.53% probability · 73th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: duckduckgo/duckduckgo
Source: cve@mitre.org

References

https://github.com/duckduckgo/Android/blob/e2f2d54a6b4452277467db403a3546512401b493/app/src/main/java/com/duckduckgo/app/global/UriExtension.kt#L83-L88Patch, Third Party Advisory
https://github.com/duckduckgo/Android/issues/527Third Party Advisory
https://github.com/duckduckgo/iOS/blob/1ae03d7221180bd6791cf6f7f06922a96335cf75/Core/AppUrls.swift#L98-L100Third Party Advisory
https://news.ycombinator.com/item?id=23708166Patch, Third Party Advisory
https://news.ycombinator.com/item?id=23711597Third Party Advisory
https://github.com/duckduckgo/Android/blob/e2f2d54a6b4452277467db403a3546512401b493/app/src/main/java/com/duckduckgo/app/global/UriExtension.kt#L83-L88Patch, Third Party Advisory
https://github.com/duckduckgo/Android/issues/527Third Party Advisory
https://github.com/duckduckgo/iOS/blob/1ae03d7221180bd6791cf6f7f06922a96335cf75/Core/AppUrls.swift#L98-L100Third Party Advisory
https://news.ycombinator.com/item?id=23708166Patch, Third Party Advisory
https://news.ycombinator.com/item?id=23711597Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.