CVSS 3.1
7.4 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NCVE-2020-8987
Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-middle can host a malicious website using a self-signed certificate. No special action necessary by the victim using AntiTrack with "Allow filtering of HTTPS traffic for tracking detection" enabled. (This is the default configuration.)
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Affected
- avast:antitrack
- avast:avg_antitrack
References
- https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast
- https://www.davideade.com/2020/03/avast-antitrack.html
- https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast
- https://www.davideade.com/2020/03/avast-antitrack.html