CVE-2020-14049

Name of the Vulnerable Software and Affected Versions Viber for Windows versions up to 13.2.0.39

Description The issue arises from Viber for Windows not properly quoting its custom URI handler, allowing a malicious website to launch Viber with arbitrary parameters. This could force a victim to send an NTLM authentication request, which could then be relayed or have its hash captured for offline password cracking.

Recommendations For versions up to 13.2.0.39, update to a version that properly quotes its custom URI handler to prevent malicious exploitation.