| CVE-2020-11614 | Date: (C)2020-06-12 (M)2023-12-22 |
Mids' Reborn Hero Designer 2.6.0.7 downloads the update manifest, as well as update files, over cleartext HTTP. Additionally, the application does not perform file integrity validation for files after download. An attacker can perform a man-in-the-middle attack against this connection and replace executable files with malicious versions, which the operating system then executes under the context of the user running Hero Designer.
CVSS Score and Metrics +CVSS Score and Metrics -| CVSS V3 Severity: | CVSS V2 Severity: |
| CVSS Score : 8.1 | CVSS Score : 6.8 |
| Exploit Score: 2.2 | Exploit Score: 8.6 |
| Impact Score: 5.9 | Impact Score: 6.4 |
| |
| CVSS V3 Metrics: | CVSS V2 Metrics: |
| Attack Vector: NETWORK | Access Vector: NETWORK |
| Attack Complexity: HIGH | Access Complexity: MEDIUM |
| Privileges Required: NONE | Authentication: NONE |
| User Interaction: NONE | Confidentiality: PARTIAL |
| Scope: UNCHANGED | Integrity: PARTIAL |
| Confidentiality: HIGH | Availability: PARTIAL |
| Integrity: HIGH | |
| Availability: HIGH | |
| | |
