Medium severity · published Mar 23, 2022
CVE-2020-20094
Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially…
6.5
CVSS
1.4%
EPSS
No
On KEV
Description
Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Instagram · Facebook
through 106.0; through 107.0.0.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-20094
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-20094
Exploit
http://packetstormsecurity.com/files/166448/RTLO-Injection-URI-Spoofing.html
Exploit
https://github.com/zadewg/RIUS
More from Instagram
7.8
CVE-2020-1895
A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions