CVE-2020-12270

Katalog CVE

CVSS 6.5 · Medium EPSS 1,4%

Kerentanan Use of Insufficiently Random Values pada bluezone. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interfere with COVID-19 contact tracing by using many IDs. NOTE: the vendor disputes the relevance of this report because the recipient of an F1 alert will know it was a false alert if contact-history comparison fails (i.e., an F0 is not actually part of the contact history obtained from the device of this recipient, or this recipient is not actually part of the contact history obtained from the device of an F0)

Rincian

Terbit di NVD

27 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-330: Use of Insufficiently Random Values

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/BluezoneGlobal/bluezone-app/blob/afa15fcec391f0edc51d0486a4ca84dd2520bbb3/CHANGELOG.md release notes · advisory pihak ketiga
• https://github.com/BluezoneGlobal/bluezone-app/blob/afa15fcec391f0edc51d0486a4ca84dd2520bbb3/package.json#L27 advisory pihak ketiga
• https://github.com/BluezoneGlobal/react-native-bluetooth-scan/blob/d9ee70fd594093a30e50b6e62a7593a8397c2dab/li... advisory pihak ketiga
• https://github.com/BluezoneGlobal/react-native-bluetooth-scan/blob/d9ee70fd594093a30e50b6e62a7593a8397c2dab/li... advisory pihak ketiga
• https://github.com/BluezoneGlobal/react-native-bluetooth-scan/blob/d9ee70fd594093a30e50b6e62a7593a8397c2dab/li... advisory pihak ketiga
• https://vnhacker.blogspot.com/2020/04/vietnams-contact-tracing-app_26.html exploit · advisory pihak ketiga
• https://bluezone.ai/CVE