CVE-2020-8989

Katalog CVE

CVSS 5.3 · Medium EPSS 1,0%

Kerentanan Observable Discrepancy pada voatz. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

In the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the available voting choices, which makes it easier for remote attackers to discover this voter's choice by sniffing the network. For example, a small amount of sniffed data may indicate that a vote was cast for the candidate with the least metadata. An active man-in-the-middle attacker can leverage this behavior to disrupt voters' abilities to vote for a candidate opposed by the attacker.

Rincian

Terbit di NVD

13 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-203: Observable Discrepancy

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.voatz.com/?p=1209 advisory vendor
• https://internetpolicy.mit.edu/wp-content/uploads/2020/02/SecurityAnalysisOfVoatz_Public.pdf advisory pihak ketiga