PT-2021-15144 · Unknown · Exposure Notification Server

Sethvargo · Published 2021-11-10 · Updated 2024-08-21 · CVE-2021-22565

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Exposure Notification server versions prior to V1.1.2

Description An attacker could prematurely expire a verification code, making it unusable by the patient, and preventing the patient from uploading their TEKs to generate exposure notifications. Users or API keys with permission to expire verification codes could have expired codes that belonged to another realm if they guessed the UUID. Verification codes can only be expired by providing their 64-bit UUID, and verification codes are already valid for a very short period of time.

Recommendations For Exposure Notification server versions prior to V1.1.2, upgrade the server to V1.1.2 or greater.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-22565

GHSA-WX8Q-RGFR-CF6V

GO-2022-0270

Affected Products

Exposure Notification Server

References · 8

• https://github.com/google/exposure-notifications-verification-server/releases/tag/v1.1.2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-22565 · Security Note
• https://osv.dev/vulnerability/GO-2022-0270 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22565 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wx8q-rgfr-cf6v · Vendor Advisory
• https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-wx8q-rgfr-cf6v · Note
• https://github.com/google/exposure-notifications-verification-server · Note
• https://t.me/cibsecurity/33678 · Telegram Post