LiveActive security incident?Get immediate response
CVE Record

CVE-2020-7705: Malicious Package

This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads.

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2020-7705 concerns MintegralAdSDK, an iOS advertising SDK reported to contain malicious behavior. When present in an app, it can track URLs users open and report obfuscated data to Mintegral servers, and it was associated with advertisement attribution fraud. Sources state the behavior can exist even when the SDK is not serving ads.

Executive priority

Treat this as high priority for any shipped iOS product using MintegralAdSDK. The business risk is privacy exposure, user trust damage, and potentially fraudulent ad attribution, rather than availability loss. If the SDK is absent, urgency drops substantially.

Technical view

The SDK can remotely activate hooks on UIApplication openURL, SKStoreProductViewController loadProductWithParameters, and NSURLProtocol methods. When active, those hooks collect opened URL activity and send obfuscated data externally. The source bundle does not name a patched version or safe configuration.

Likely exposure

Exposure is most likely in iOS applications that include the CocoaPods package MintegralAdSDK. The stated affected range starts at 0.0.0, but the bundle does not provide a precise fixed-version boundary. Apps remain relevant for review even if Mintegral ads were not enabled.

Exploitation context

This is not listed as CISA KEV in the supplied bundle. The concern is malicious functionality embedded in the SDK and remotely activated hooks, not a separately documented public exploit chain. Sources support data leakage and ad attribution fraud claims, but not broader device compromise.

Researcher notes

Evidence is source-limited to CVE and Snyk reporting. Validate by dependency and binary presence, then assess runtime network behavior. Avoid assuming a patched version because the supplied sources do not identify one. No KEV-backed active exploitation signal is provided.

Mitigation direction

  • Inventory iOS apps and builds for MintegralAdSDK usage.
  • Remove MintegralAdSDK unless vendor guidance identifies a trustworthy fixed release.
  • Rebuild and re-release affected apps after removal or replacement.
  • Review privacy, ad attribution, and partner reporting impact.
  • Check Snyk and vendor guidance before accepting replacement SDK versions.

Validation and detection

  • Search Podfile.lock, dependency manifests, and build artifacts for MintegralAdSDK.
  • Inspect shipped app bundles for Mintegral frameworks or classes.
  • Review network telemetry for unexpected traffic to Mintegral-controlled endpoints.
  • Confirm production builds no longer include the SDK.
  • Document affected app versions and customer exposure windows.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-7705 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N/E:H/RL:U/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N/E:H/RL:U/RC:C2.84.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2020-7705Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N/E:H/RL:U/RC:C

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aMintegralAdSDK0.0.0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.