PT-2020-20411 · Voatz · Voatz

Published 2020-02-13 · Updated 2021-07-21 · CVE-2020-8988

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Voatz application 2020-01-01 for Android

Description The issue allows attackers to discover login credentials and voting history via an offline brute-force approach after gaining root access and making a copy of the local database. This is due to the application only allowing 100 million different PINs.

Recommendations For Voatz application 2020-01-01 for Android, consider implementing additional security measures to protect against brute-force attacks, such as limiting the number of login attempts or using more secure authentication methods. As a temporary workaround, restrict access to the local database to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

CWE-521

Related Identifiers

CVE-2020-8988

Affected Products

Voatz

References · 5

• https://osv.dev/vulnerability/CVE-2020-8988 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8988 · Security Note
• https://blog.voatz.com/?p=1209 · Vendor Advisory
• https://internetpolicy.mit.edu/wp-content/uploads/2020/02/SecurityAnalysisOfVoatz_Public.pdf · Note
• https://t.me/cvenotify/1022 · Telegram Post