WebRTC Vulnerability: Private IP Address Disclosure in DuckDuckGo 4.2.0

CVE-2018-6849 · MEDIUM Severity

AV:N/AC:M/AU:N/C:P/I:N/A:N

In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.

Learn more about our Web App Pen Testing.