{"cve":"CVE-2020-7705","nvd":{"published":"2020-08-24T18:15:10.143","modified":"2026-06-17T03:25:17.910","status":"Modified","description":"This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":8.1},"cwes":["CWE-1021"],"references":["https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/","https://snyk.io/research/sour-mint-malicious-sdk/","https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852","https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/","https://snyk.io/research/sour-mint-malicious-sdk/"],"products":["mintegral:mintegraladsdk"],"source":"nvd","synced_at":"2026-10-19T21:09:20.498348299+00:00"},"epss":{"cve":"CVE-2020-7705","score":0.0117,"percentile":0.67414,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}