High severity · published Jul 29, 2020
CVE-2020-13699
TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers
8.8
CVSS
25.8%
EPSS
No
On KEV
Description
TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parameters, as demonstrated by a teamviewer10: --play URL. An attacker could force a victim to send an NTLM authentication request and either relay the request or capture the hash for offline password cracking. This affects teamviewer10, teamviewer8, teamviewerapi, tvchat1, tvcontrol1, tvfiletransfer1, tvjoinv8, tvpresent1, tvsendfile1, tvsqcustomer1, tvsqsupport1, tvvideocall1, and tvvpn1. The issue is fixed in 8.0.258861, 9.0.258860, 10.0.258873, 11.0.258870, 12.0.258869, 13.2.36220, 14.2.56676, 14.7.48350, and 15.8.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)25.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
Teamviewer · Teamviewer
before 15.8.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-13699
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-13699
Vendor Advisory
https://community.teamviewer.com/t5/Announcements/Statement-on-CVE-2020-13699/td-p/98448
Third Party Advisory
https://jeffs.sh/CVEs/CVE-2020-13699.txt
More from Teamviewer
7.0
CVE-2019-18988
TeamViewer Desktop Bypass Remote Login Vulnerability
9.8
CVE-2018-16550
TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by skipping the "Cancel" step, which makes it easier to…
8.8
CVE-2021-34859
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0
8.8
CVE-2019-18251
In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS
8.1
CVE-2018-14333
TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between "[00 88] and "[00 00 00]" delimiters, which might make it easier for…