PT-2020-13172 · Okhttp+1 · Okhttp+1

Published 2020-05-03 · Updated 2021-07-21 · CVE-2020-12624

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The League application versions prior to 2020-05-02

Description The issue allows remote attackers to hijack sessions because the application sends a bearer token in an HTTP Authorization header to an arbitrary web site hosting an external image. This occurs due to the reuse of an OkHttp object.

Recommendations For versions prior to 2020-05-02, consider restricting access to external images to minimize the risk of session hijacking until a fix is applied. As a temporary workaround, avoid using the OkHttp object for external image requests.

Exploit

Fix

Weakness Enumeration

CWE-459

Related Identifiers

CVE-2020-12624

Affected Products

Okhttp

The League

References · 4

• 🔥 https://push32.com/post/dating-app-fail · Exploit
• https://osv.dev/vulnerability/CVE-2020-12624 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12624 · Security Note
• https://t.me/cvenotify/3498 · Telegram Post