CVE-2020-24722
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GAEN是一个隐私保护的接触者追踪项目，由Apple和Google共同开发的框架和协议规范，用于促进COVID-19大流行期间的数字接触者追踪。 GAEN 协议存在安全漏洞，该漏洞源于加密的元数据块TX价值缺乏一个校验和,允许bitflipping扩大污染攻击。这可能会导致元数据deanonymization和风险分数膨胀。
Possible ATT&CK Techniques 3 AI
T1040 · Network Sniffing T1055 · Process Injection T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-24722
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in COVID-19 applications on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflipping to amplify a contamination attack. This can cause metadata deanonymization and risk-score inflation. NOTE: the vendor's position is "We do not believe that TX power authentication would be a useful defense against relay attacks.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
GAEN 协议安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GAEN是一个隐私保护的接触者追踪项目，由Apple和Google共同开发的框架和协议规范，用于促进COVID-19大流行期间的数字接触者追踪。 GAEN 协议存在安全漏洞，该漏洞源于加密的元数据块TX价值缺乏一个校验和,允许bitflipping扩大污染攻击。这可能会导致元数据deanonymization和风险分数膨胀。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2020-24722
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-24722
请登录查看更多情报信息。
Exploits & Public PoCs for CVE-2020-24722 (1)
Mailing List Discussions for CVE-2020-24722 (1)
-
http://seclists.org/fulldisclosure/2020/Oct/12 x_refsource_MISC
Security Blog Posts for CVE-2020-24722 (1)
Other References for CVE-2020-24722 (1)
Same Patch Batch · n/a · 2020-10-07 · 17 CVEs total
| CVE-2020-7742 | 7.5 HIGH | Prototype Pollution |
| CVE-2020-25985 | Mono 路径遍历漏洞 | |
| CVE-2020-25343 | Symphony CMS 跨站脚本漏洞 | |
| CVE-2020-14355 | 红帽 SPICE remote display system 缓冲区错误漏洞 | |
| CVE-2020-11800 | Zabbix SIA Zabbix 安全漏洞 | |
| CVE-2019-16160 | MikroTik RouterOS 输入验证错误漏洞 | |
| CVE-2020-24246 | Peplink Balance 安全漏洞 | |
| CVE-2020-26596 | WordPress Elementor Pro 输入验证错误漏洞 | |
| CVE-2020-26870 | DOMPurify 跨站脚本漏洞 | |
| CVE-2020-17551 | ImpressCMS 跨站脚本漏洞 | |
| CVE-2020-26876 | WordPress 安全漏洞 | |
| CVE-2020-26880 | Sympa 安全漏洞 | |
| CVE-2020-26164 | kdeconnect-kde 资源管理错误漏洞 | |
| CVE-2020-25768 | Contao 输入验证错误漏洞 | |
| CVE-2020-25867 | SOPlanning 授权问题漏洞 | |
| CVE-2020-15501 | Smarter Coffee Maker 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2020-24722
No comments yet