{"containers": {"cna": {"affected": [{"product": "MintegralAdSDK", "vendor": "n/a", "versions": [{"lessThan": "unspecified", "status": "affected", "version": "0.0.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Snyk Security Team"}], "datePublic": "2020-08-24T00:00:00", "descriptions": [{"lang": "en", "value": "This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "exploitCodeMaturity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "remediationLevel": "UNAVAILABLE", "reportConfidence": "CONFIRMED", "scope": "UNCHANGED", "temporalScore": 7.1, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N/E:H/RL:U/RC:C", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Malicious Package", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-08-24T17:15:15", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852"}, {"tags": ["x_refsource_MISC"], "url": "https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/"}, {"tags": ["x_refsource_MISC"], "url": "https://snyk.io/research/sour-mint-malicious-sdk/"}], "title": "Malicious Package", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "report@snyk.io", "DATE_PUBLIC": "2020-08-24T17:11:17.050722Z", "ID": "CVE-2020-7705", "STATE": "PUBLIC", "TITLE": "Malicious Package"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "MintegralAdSDK", "version": {"version_data": [{"version_affected": ">=", "version_value": "0.0.0"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "Snyk Security Team"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N/E:H/RL:U/RC:C", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Malicious Package"}]}]}, "references": {"reference_data": [{"name": "https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852"}, {"name": "https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/", "refsource": "MISC", "url": "https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/"}, {"name": "https://snyk.io/research/sour-mint-malicious-sdk/", "refsource": "MISC", "url": "https://snyk.io/research/sour-mint-malicious-sdk/"}]}}}}, "cveMetadata": {"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2020-7705", "datePublished": "2020-08-24T00:00:00", "dateReserved": "2020-01-21T00:00:00", "dateUpdated": "2020-08-24T17:15:15", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mintegral:mintegraladsdk:*:*:*:*:*:*:*:*", "matchCriteriaId": "A3713524-33F9-462A-8FC0-BE573B08DA10", "versionStartIncluding": "0.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads."}, {"lang": "es", "value": "Esto afecta al paquete MintegralAdSDK desde la versi\u00f3n 0.0.0. El SDK distribuido por la empresa contiene una funcionalidad maliciosa que rastrea cualquier URL abierta por la aplicaci\u00f3n y la reporta a la empresa, adem\u00e1s de llevar a cabo un fraude de atribuci\u00f3n publicitaria. Mintegral puede remotamente activar hooks en los m\u00e9todos UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters y NSURLProtocol junto con la protecci\u00f3n de detecci\u00f3n de proxy y anti-debug. Si esos hooks est\u00e1n activos, MintegralAdSDK env\u00eda datos ofuscados sobre cada URL abierta en una aplicaci\u00f3n hacia sus servidores. Tome en cuenta que la funcionalidad maliciosa est\u00e1 habilitada incluso si el SDK no estaba habilitado para publicar anuncios."}], "id": "CVE-2020-7705", "lastModified": "2020-09-02T14:53:50.817", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "report@snyk.io", "type": "Secondary"}]}, "published": "2020-08-24T18:15:10.143", "references": [{"source": "report@snyk.io", "tags": ["Third Party Advisory"], "url": "https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/"}, {"source": "report@snyk.io", "tags": ["Third Party Advisory"], "url": "https://snyk.io/research/sour-mint-malicious-sdk/"}, {"source": "report@snyk.io", "tags": ["Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1021"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}