CVE-2020-8989
CVSS V2 Medium 5
CVSS V3 Medium 5.3
Description
In the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the available voting choices, which makes it easier for remote attackers to discover this voter's choice by sniffing the network. For example, a small amount of sniffed data may indicate that a vote was cast for the candidate with the least metadata. An active man-in-the-middle attacker can leverage this behavior to disrupt voters' abilities to vote for a candidate opposed by the attacker.
Overview
- CVE ID
- CVE-2020-8989
- Assigner
- cve@mitre.org
- Vulnerability Status
- Analyzed
- Published Version
- 2020-02-13T21:15:12
- Last Modified Date
- 2020-02-27T16:56:39
Weakness Enumerations
CPE Configuration (Product)
CPE | Vulnerable | Operator | Version Start | Version End |
---|---|---|---|---|
cpe:2.3:a:voatz:voatz:2020-01-01:*:*:*:*:android:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:N/C:P/I:N/A:N
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- NONE
- Availability Impact
- NONE
- Base Score
- 5
- Severity
- MEDIUM
- Exploitability Score
- 10
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- LOW
- Availability Impact
- NONE
- Base Score
- 5.3
- Base Severity
- MEDIUM
- Exploitability Score
- 3.9
- Impact Score
- 1.4
References
Reference URL | Reference Tags |
---|---|
https://blog.voatz.com/?p=1209 | Vendor Advisory |
https://internetpolicy.mit.edu/wp-content/uploads/2020/02/SecurityAnalysisOfVoatz_Public.pdf | Third Party Advisory |
Sources
Source Name | Source URL |
---|---|
NIST | https://nvd.nist.gov/vuln/detail/CVE-2020-8989 |
MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8989 |
History
Created | Old Value | New Value | Data Type | Notes |
---|---|---|---|---|
2022-05-10 16:48:40 | Added to TrackCVE | |||
2022-12-04 11:21:40 | 2020-02-13T21:15Z | 2020-02-13T21:15:12 | CVE Published Date | updated |
2022-12-04 11:21:40 | 2020-02-27T16:56:39 | CVE Modified Date | updated | |
2022-12-04 11:21:40 | Analyzed | Vulnerability Status | updated |