CVE-2020-15502

published 2020-07-02

CVE-2020-15502: The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers…

Priority P3 36 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has stated "the favicon service adheres to our strict privacy policy.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
duckduckgo	duckduckgo	<= 5.58.0	—
duckduckgo	duckduckgo	<= 7.47.1.0	—

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200