CVE-2021-22565

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.

CVSS v3 6.5 MEDIUM
CVSS v2.0 5.8 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:P

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/google/exposure-notifications-verification-server/releases/tag/v1.1.2	Patch Release Notes Third Party Advisory
https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-wx8q-rgfr-cf6v	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:google:exposure_notification_verification_server:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-12-09 13:15

Updated : 2024-02-28 18:48

NVD link : CVE-2021-22565

Mitre link : CVE-2021-22565

CVE.ORG link : CVE-2021-22565

JSON object : View

Products Affected

google

exposure_notification_verification_server

CWE

NVD-CWE-Other CWE-284

Improper Access Control

{"id": "CVE-2021-22565", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cve-coordination@google.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2021-12-09T13:15:08.767", "references": [{"url": "https://github.com/google/exposure-notifications-verification-server/releases/tag/v1.1.2", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "source": "cve-coordination@google.com"}, {"url": "https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-wx8q-rgfr-cf6v", "tags": ["Third Party Advisory"], "source": "cve-coordination@google.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "cve-coordination@google.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater."}, {"lang": "es", "value": "Un atacante podr\u00eda hacer expirar prematuramente un c\u00f3digo de verificaci\u00f3n, haci\u00e9ndolo inusable por el paciente, haciendo que \u00e9ste no pueda cargar sus TEKs para generar notificaciones de exposici\u00f3n. Se recomienda actualizar el Servidor de Notificaciones de Exposici\u00f3n a la versi\u00f3n 1.1.2 o superior"}], "lastModified": "2022-10-25T16:20:42.343", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:google:exposure_notification_verification_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C922D69E-FD60-4DD6-9E8F-96F5FB422462", "versionEndExcluding": "1.1.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@google.com"}