What’s Vulnerable › Vulnerabilities
CVE-2020-8987
- Severity: high (CVSS 7.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-03-09 · updated 2026-06-17
- Weakness: CWE-295
Description
Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-middle can host a malicious website using a self-signed certificate. No special action necessary by the victim using AntiTrack with "Allow filtering of HTTPS traffic for tracking detection" enabled. (This is the default configuration.)
Affected products
- Avast Antitrack: before 1.5.1.172 — fixed in 1.5.1.172
- Avast Avg Antitrack: before 2.0.0.178 — fixed in 2.0.0.178
How to fix
Upgrade to a fixed version: Avast Antitrack 1.5.1.172; Avast Avg Antitrack 2.0.0.178. Check the vendor advisory for mitigations.
References
- https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast
- https://www.davideade.com/2020/03/avast-antitrack.html
- https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast
- https://www.davideade.com/2020/03/avast-antitrack.html
Get alerted when CVE-2020-8987 or the next vulnerability affects your stack