CVE-2020-15165 - Vulnerability Details - OpenCVE

Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as possible. For more information, review the referenced GitHub Security Advisory.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Chameleon Mini Live Debugger Project	Chameleon Mini Live Debugger

Configuration 1 [-]

cpe:2.3:a:chameleon_mini_live_debugger_project:chameleon_mini_live_debugger:1.1.6:*:*:*:*:android:*:*

No data.

References

Link	Providers
https://github.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6
https://play.google.com/store/apps/details?id=com.maxieds.chameleonminilivedebugger&hl=en_US

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2020-08-28T17:30:14

Updated: 2024-08-04T13:08:22.249Z

Reserved: 2020-06-25T00:00:00

Link: CVE-2020-15165

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-08-28T18:15:10.167

Modified: 2024-11-21T05:04:59.103

Link: CVE-2020-15165

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "ChameleonMiniLiveDebugger", "vendor": "maxieds", "versions": [{"status": "affected", "version": "= v1.1.6-free"}]}], "descriptions": [{"lang": "en", "value": "Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as possible. For more information, review the referenced GitHub Security Advisory."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-506", "description": "CWE-506: Embedded Malicious Code", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-08-28T17:30:13", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6"}, {"tags": ["x_refsource_MISC"], "url": "https://play.google.com/store/apps/details?id=com.maxieds.chameleonminilivedebugger&hl=en_US"}], "source": {"advisory": "GHSA-8q77-7hq8-f7g6", "discovery": "UNKNOWN"}, "title": "Potentially tampered sources on Play Store for Chameleon Mini Live Debugger", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-15165", "STATE": "PUBLIC", "TITLE": "Potentially tampered sources on Play Store for Chameleon Mini Live Debugger"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ChameleonMiniLiveDebugger", "version": {"version_data": [{"version_value": "= v1.1.6-free"}]}}]}, "vendor_name": "maxieds"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as possible. For more information, review the referenced GitHub Security Advisory."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-506: Embedded Malicious Code"}]}]}, "references": {"reference_data": [{"name": "https://github.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6", "refsource": "CONFIRM", "url": "https://github.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6"}, {"name": "https://play.google.com/store/apps/details?id=com.maxieds.chameleonminilivedebugger&hl=en_US", "refsource": "MISC", "url": "https://play.google.com/store/apps/details?id=com.maxieds.chameleonminilivedebugger&hl=en_US"}]}, "source": {"advisory": "GHSA-8q77-7hq8-f7g6", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T13:08:22.249Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://play.google.com/store/apps/details?id=com.maxieds.chameleonminilivedebugger&hl=en_US"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-15165", "datePublished": "2020-08-28T17:30:14", "dateReserved": "2020-06-25T00:00:00", "dateUpdated": "2024-08-04T13:08:22.249Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:chameleon_mini_live_debugger_project:chameleon_mini_live_debugger:1.1.6:*:*:*:*:android:*:*", "matchCriteriaId": "EE26620E-E352-4846-A9E7-CFDE44CD9430", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as possible. For more information, review the referenced GitHub Security Advisory."}, {"lang": "es", "value": "La versi\u00f3n 1.1.6-free de Chameleon Mini Live Debugger en Google Play Store, puede haber tenido sus fuentes o permisos alterados por un actor malicioso. El mantenedor oficial del paquete esta recomendando a todos los usuarios que actualicen a la v1.1.8 tan pronto como sea posible. Para m\u00e1s informaci\u00f3n, revise el Aviso de Seguridad de GitHub al que se hace referencia"}], "id": "CVE-2020-15165", "lastModified": "2024-11-21T05:04:59.103", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-08-28T18:15:10.167", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6"}, {"source": "security-advisories@github.com", "tags": ["Product", "Third Party Advisory"], "url": "https://play.google.com/store/apps/details?id=com.maxieds.chameleonminilivedebugger&hl=en_US"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Third Party Advisory"], "url": "https://play.google.com/store/apps/details?id=com.maxieds.chameleonminilivedebugger&hl=en_US"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-506"}], "source": "security-advisories@github.com", "type": "Secondary"}]}