nvd-json-data-feeds/CVE-2020/CVE-2020-252xx/CVE-2020-25203.json

{
  "id": "CVE-2020-25203",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2020-09-25T04:23:04.763",
  "lastModified": "2020-10-06T19:58:07.013",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "The Framer Preview application 12 for Android exposes com.framer.viewer.FramerViewActivity to other applications. By calling the intent with the action set to android.intent.action.VIEW, any other application is able to load any website/web content into the application's context, which is shown as a full-screen overlay to the user."
    },
    {
      "lang": "es",
      "value": "La aplicaci\u00f3n Framer Preview versi\u00f3n 12 para Android, expone com.framer.viewer.FramerViewActivity a otras aplicaciones. Al llamar el intent con la acci\u00f3n establecida en android.intent.action.VIEW, cualquier otra aplicaci\u00f3n es capaz de cargar cualquier sitio web y contenido web en el contexto de la aplicaci\u00f3n, que es mostrada como una superposici\u00f3n de pantalla completa para el usuario"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
          "accessVector": "LOCAL",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "NONE",
          "baseScore": 1.9
        },
        "baseSeverity": "LOW",
        "exploitabilityScore": 3.4,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:framer:framer_preview:12.0:*:*:*:*:android:*:*",
              "matchCriteriaId": "2F99EFF4-3E72-46B1-9FA6-0BC1374CEF70"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/159264/Framer-Preview-12-Content-Injection.html",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "https://rcesecurity.com",
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ]
    }
  ]
}