PT-2020-15794 · Expo · Expo

Cjthompson · Published 2020-08-26 · Updated 2022-05-24 · CVE-2020-24653

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Expo versions through 9.1.0 on iOS

Description The issue concerns the secure-store in Expo, which provides an insecure policy kSecAttrAccessibleAlwaysThisDeviceOnly when WHEN UNLOCKED THIS DEVICE ONLY is used. This affects the security of data storage on iOS devices.

Recommendations For Expo versions through 9.1.0 on iOS, consider updating to a version that addresses this issue, as the current version provides an insecure policy that may compromise data security. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-24653

GHSA-RWX9-WQJ8-VR77

Affected Products

Expo

References · 7

• https://github.com/expo/expo/pull/9264 · Patch
• https://osv.dev/vulnerability/GHSA-rwx9-wqj8-vr77 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24653 · Security Note
• https://github.com/expo/expo · Note
• https://github.com/expo/expo/blob/main/packages/expo-secure-store/CHANGELOG.md · Note
• https://github.com/expo/expo/commit/1d82bf07fae2c96273e9189997e521359cffc1a9#diff-5b2820f378da980bd8a8185e2e1b2f9ce085d834534483f29c67932f282cc5c9 · Note