CVE-2020-13702

Katalog CVE

CVSS 10.0 · Critical EPSS 2,2%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada the rolling proximity identifier project the rolling proximity identifier. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

The Rolling Proximity Identifier used in the Apple/Google Exposure Notification API beta through 2020-05-29 enables attackers to circumvent Bluetooth Smart Privacy because there is a secondary temporary UID. An attacker with access to Beacon or IoT networks can seamlessly track individual device movement via a Bluetooth LE discovery mechanism.

Rincian

Terbit di NVD

11 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 81,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/google/exposure-notifications-internals/commit/8f751a666697 patch · advisory pihak ketiga
• https://github.com/google/exposure-notifications-internals/commit/8f751a666697c3cae0a56ae3464c2c6cbe31b69e patch · advisory pihak ketiga
• https://blog.google/documents/70/Exposure_Notification_-_Bluetooth_Specification_v1.2.2.pdf advisory pihak ketiga
• https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200611.pdf exploit · deskripsi teknis · advisory pihak ketiga
• https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200616-2.pdf exploit · deskripsi teknis · advisory pihak ketiga
• https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200616.pdf exploit · deskripsi teknis · advisory pihak ketiga