5.7

CVE-2020-14292

Exploit

EPSS 0.26%
Veröffentlicht 09.09.2020 17:15:25
Zuletzt bearbeitet 21.11.2024 05:02:56
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

In the COVIDSafe application through 1.0.21 for Android, unsafe use of the Bluetooth transport option in the GATT connection allows attackers to trick the application into establishing a connection over Bluetooth BR/EDR transport, which reveals the public Bluetooth address of the victim's phone without authorisation, bypassing the Bluetooth address randomisation protection in the user's phone.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 0 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Health ≫ Covidsafe SwPlatformandroid Version <= 1.0.21

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.26%	0.462

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.7	2.1	3.6	CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvd@nist.gov	2.9	5.5	2.9	AV:A/AC:M/Au:N/C:P/I:N/A:N

https://www.health.gov.au/resources/apps-and-tools/covidsafe-app

Third Party Advisory

Product

https://covidsafe.watch/issue-register/

Vendor Advisory

https://github.com/AU-COVIDSafe/mobile-android/blob/b827cf3ccef72a3d38c6fc37466a99868823540f/app/src/main/java/au/gov/health/covidsafe/streetpass/Work.kt#L35-L41

Third Party Advisory

Exploit

https://github.com/alwentiu/CVE-2020-14292

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2020-14292

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-14292

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-14292

EUVD