CVE-2021-33838

Опубликовано: 04 июн. 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration.

Ссылки

https://github.com/mame82/misc/blob/master/luca_traceIds.md
Third Party Advisory
https://luca-app.de/securityoverview/properties/objectives.html
Vendor Advisory
https://www.ccc.de/de/updates/2021/luca-app-ccc-fordert-bundesnotbremse
Third Party Advisory
https://www.youtube.com/playlist?list=PLKuX6iczGb3kuDsm2RFgbmRkTugkR9-UE
Exploit
Third Party Advisory
https://github.com/mame82/misc/blob/master/luca_traceIds.md
Third Party Advisory
https://luca-app.de/securityoverview/properties/objectives.html
Vendor Advisory
https://www.ccc.de/de/updates/2021/luca-app-ccc-fordert-bundesnotbremse
Third Party Advisory
https://www.youtube.com/playlist?list=PLKuX6iczGb3kuDsm2RFgbmRkTugkR9-UE
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:luca-app:luca:*:*:*:*:*:android:*:*

Версия до 1.7.4 (включая)

EPSS

Процентиль: 86%

0.02868

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-203

Связанные уязвимости

GHSA-p3j7-5j28-hvpx