Vulnerability · NVD

CVE-2021-44683

CVE-2021-44683, high severity (CVSS 8.2): 1 tracked app concerned, all fixed or indeterminable on their current version.

Severity (CVSS): 8.2
Exploitation: 1.0 %
Tracked apps: 1
Still exposed: 0

Published on 2022-03-25

The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the JavaScript window.open function (used to open a secondary browser window). This could be exploited by tricking users into supplying sensitive information such as credentials, because the address bar would display a legitimate URL, but content would be hosted on the attacker's web site.

Attack vector : Network No privileges required

Show raw CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

EPSS 0.97% above median percentile 61.6%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

DuckDuckGo iOS com.duckduckgo.mobile.ios

Affected <7.64.18 Fixed in 7.64.18 Latest tracked 7.242.0 patched

Vulnerable CPE configurations (1)

Vendor	Product	Platform	Versions	CPE 2.3 URI
duckduckgo	duckduckgo iOS	iOS	<7.64.18	cpe:2.3:a:duckduckgo:duckduckgo::::::iphone_os::*

View on NVD ↗

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM