CVE-2021-37786

Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of exceptional conditions. This affects COVID Certificate App IOS 2.2.0 and below affected, patch in progress and COVID Certificate Check App IOS 2.2.0 and below affected, patch in progress. A denial of service (physically proximate) could be caused by scanning a crafted QR code.

CVSS v3 4.6 MEDIUM
CVSS v2.0 2.1 LOW

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/admin-ch/CovidCertificate-App-iOS/issues/146	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bag:covid_certificate:*:*:*:*:*:iphone_os:*:*

History

No history.

Information

Published : 2021-09-27 14:15

Updated : 2024-02-28 18:48

NVD link : CVE-2021-37786

Mitre link : CVE-2021-37786

CVE.ORG link : CVE-2021-37786

JSON object : View

Products Affected

bag

covid_certificate

CWE

CWE-755

Improper Handling of Exceptional Conditions

{"id": "CVE-2021-37786", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2021-09-27T14:15:08.583", "references": [{"url": "https://github.com/admin-ch/CovidCertificate-App-iOS/issues/146", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-755"}]}], "descriptions": [{"lang": "en", "value": "Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of exceptional conditions. This affects COVID Certificate App IOS 2.2.0 and below affected, patch in progress and COVID Certificate Check App IOS 2.2.0 and below affected, patch in progress. A denial of service (physically proximate) could be caused by scanning a crafted QR code."}, {"lang": "es", "value": "Determinados productos de la Oficina Federal de Sistemas de Tecnolog\u00eda de la Informaci\u00f3n y Telecomunicaciones FOITT est\u00e1n afectadas por un manejo inapropiado de condiciones excepcionales. Esto afecta a COVID Certificate App IOS versi\u00f3n 2.2.0 y por debajo afectada, parche en curso y COVID Certificate Check App IOS versi\u00f3n 2.2.0 y por debajo afectada, parche en curso. Se podr\u00eda causar una denegaci\u00f3n de servicio (f\u00edsicamente pr\u00f3xima) al escanear un c\u00f3digo QR dise\u00f1ado"}], "lastModified": "2021-10-07T14:19:49.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bag:covid_certificate:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "6BE6A000-79F1-4751-AD7C-90B59914BB55", "versionEndIncluding": "2.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}