CVE-2020-8989

{"id": "CVE-2020-8989", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2020-02-13T21:15:12.740", "references": [{"url": "https://blog.voatz.com/?p=1209", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://internetpolicy.mit.edu/wp-content/uploads/2020/02/SecurityAnalysisOfVoatz_Public.pdf", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "In the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the available voting choices, which makes it easier for remote attackers to discover this voter's choice by sniffing the network. For example, a small amount of sniffed data may indicate that a vote was cast for the candidate with the least metadata. An active man-in-the-middle attacker can leverage this behavior to disrupt voters' abilities to vote for a candidate opposed by the attacker."}, {"lang": "es", "value": "En la aplicaci\u00f3n Voatz 2020-01-01 para Android, la cantidad de datos transmitidos durante el voto de un solo votante depende de las diferentes longitudes de metadatos por medio de las opciones de votaci\u00f3n disponibles, facilitando a atacantes remotos descubrir esta elecci\u00f3n del votante rastreando la red. Por ejemplo, una peque\u00f1a cantidad de datos analizados puede indicar que se emiti\u00f3 un voto para el candidato con la menor cantidad de metadatos. Un atacante de tipo man-in-the-middle puede aprovechar este comportamiento para alterar las habilidades de los votantes para votar por un candidato al que se oponga el atacante."}], "lastModified": "2020-02-27T16:56:39.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:voatz:voatz:2020-01-01:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "9AF7D11D-9F99-460E-91B6-2A7019008809"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}