CVE-2020-12491 - Vulnerability Details - OpenCVE

Improper control of framework service permissions with possibility of some sensitive device information leakage.

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00032.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2020-4793	Improper control of framework service permissions with possibility of some sensitive device information leakage.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.vivo.com/en/support/security-advisory-detail?id=11

History

Mon, 25 Nov 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 25 Nov 2024 10:15:00 +0000

Type	Values Removed	Values Added
Description		Improper control of framework service permissions with possibility of some sensitive device information leakage.
Title		Framework Information Disclosure Vulnerability
Weaknesses		CWE-306
References		https://www.vivo.com/en/support/security-advisory-detail?id=11
Metrics		cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Vivo

Published: 2024-11-25T10:08:14.791Z

Updated: 2024-11-25T17:03:03.193Z

Reserved: 2020-04-30T00:00:00.000Z

Link: CVE-2020-12491

Vulnrichment

Updated: 2024-11-25T17:02:57.524Z

NVD

Status : Received

Published: 2024-11-25T10:15:04.983

Modified: 2024-11-25T10:15:04.983

Link: CVE-2020-12491

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2020-12491", "assignerOrgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8", "state": "PUBLISHED", "assignerShortName": "Vivo", "dateReserved": "2020-04-30T00:00:00.000Z", "datePublished": "2024-11-25T10:08:14.791Z", "dateUpdated": "2024-11-25T17:03:03.193Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Framework", "vendor": "vivo", "versions": [{"status": "affected", "version": "ard11 and below versions released before 2022.2.24"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper control of framework service permissions with possibility of some sensitive device information leakage.<br>"}], "value": "Improper control of framework service permissions with possibility of some sensitive device information leakage."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 4.8, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8", "shortName": "Vivo", "dateUpdated": "2024-11-25T10:08:14.791Z"}, "references": [{"url": "https://www.vivo.com/en/support/security-advisory-detail?id=11"}], "source": {"discovery": "UNKNOWN"}, "title": "Framework Information Disclosure Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-25T17:02:53.241577Z", "id": "CVE-2020-12491", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-25T17:03:03.193Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2020-12491", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-25T17:02:53.241577Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-25T17:02:57.524Z"}}], "cna": {"title": "Framework Information Disclosure Vulnerability", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "vivo", "product": "Framework", "versions": [{"status": "affected", "version": "ard11 and below versions released before 2022.2.24"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.vivo.com/en/support/security-advisory-detail?id=11"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper control of framework service permissions with possibility of some sensitive device information leakage.", "supportingMedia": [{"type": "text/html", "value": "Improper control of framework service permissions with possibility of some sensitive device information leakage.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8", "shortName": "Vivo", "dateUpdated": "2024-11-25T10:08:14.791Z"}}}, "cveMetadata": {"cveId": "CVE-2020-12491", "state": "PUBLISHED", "dateUpdated": "2024-11-25T17:03:03.193Z", "dateReserved": "2020-04-30T00:00:00.000Z", "assignerOrgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8", "datePublished": "2024-11-25T10:08:14.791Z", "assignerShortName": "Vivo"}, "dataVersion": "5.1"}