CVEvulnerability
CVE-2020-15502
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-07-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has stated "the favicon service adheres to our strict privacy policy.
Affected configurations
• duckduckgo duckduckgo (<= 5.58.0)
• duckduckgo duckduckgo (<= 7.47.1.0)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/duckduckgo/Android/blob/e2f2d54a6b4452277467db403a3546512401b493/app/src/main/java/com/duckduckgo/app/global/UriExtension.kt#L83-L88 Patch, Third Party Advisory
- https://github.com/duckduckgo/Android/issues/527 Third Party Advisory
- https://github.com/duckduckgo/iOS/blob/1ae03d7221180bd6791cf6f7f06922a96335cf75/Core/AppUrls.swift#L98-L100 Third Party Advisory
- https://news.ycombinator.com/item?id=23708166 Patch, Third Party Advisory
- https://news.ycombinator.com/item?id=23711597 Third Party Advisory
- https://github.com/duckduckgo/Android/blob/e2f2d54a6b4452277467db403a3546512401b493/app/src/main/java/com/duckduckgo/app/global/UriExtension.kt#L83-L88 Patch, Third Party Advisory
- https://github.com/duckduckgo/Android/issues/527 Third Party Advisory
- https://github.com/duckduckgo/iOS/blob/1ae03d7221180bd6791cf6f7f06922a96335cf75/Core/AppUrls.swift#L98-L100 Third Party Advisory
- https://news.ycombinator.com/item?id=23708166 Patch, Third Party Advisory
- https://news.ycombinator.com/item?id=23711597 Third Party Advisory