CVE-2020-8102 Insufficient URL sanitization and validation in Safepay Browser (VA-8631)
An attacker can execute remote commands in the Safepay Utility process via a crafted web page due to insufficient URL validation in Bitdefender Total Security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-8102?
CVE-2020-8102 is a high-severity command injection vulnerability in Bitdefender Total Security 2020, published on 22 Jun 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper Input Validation vulnerability in the Safepay browser component of Bitdefender Total Security 2020 allows an external, specially crafted web page to run remote commands inside the Safepay Utility process. This issue affects Bitdefender Total Security 2020 versions prior to 24.0.20.116.
Weakness: CWE-20
Which versions are affected by CVE-2020-8102?
It affects 1 product.
Products include Bitdefender Total Security 2020.
How do I fix CVE-2020-8102?
No fix has been published for CVE-2020-8102 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-8102 being exploited?
There is no known exploitation of CVE-2020-8102 in the wild and no public exploit code.
Other vulnerabilities in Bitdefender Total Security 2020
Sources
Also known as GHSA-frgh-7pf4-6v6f.