VulnerabilityModified
CVE-2020-27414
This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header, MITM or browser history.
MEDIUM 5.9EPSS 1.00%
Does this matter?
Lower severity and a low EPSS score (1.00%). Track it; it rarely justifies an emergency change on its own.
Description
Mahavitaran android application 7.50 and prior transmit sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header, MITM or browser history.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.00% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- mahadiscom/mahavitaran
- Source
- cve@mitre.org
References
- https://cvewalkthrough.com/cve-2020-27414-mahavitaran-android-application-insecure-communication-of-sensitive-dat/Exploit, Third Party Advisory
- https://cvewalkthrough.com/cve-2020-27414-mahavitaran-android-application-insecure-communication-of-sensitive-dat/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.