CVE-2020-12492 - Vulnerability Details - OpenCVE

ReportizFlow

Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://www.vivo.com/en/support/security-advisory-detail?id=12

History

Mon, 25 Nov 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 25 Nov 2024 10:15:00 +0000

Type	Values Removed	Values Added
Description		Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information.
Title		Wifi information acquisition vulnerability in Framework Services
Weaknesses		CWE-306
References		https://www.vivo.com/en/support/security-advisory-detail?id=12
Metrics		cvssV4_0 `{'score': 1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Vivo

Published: 2024-11-25T10:11:30.761Z

Updated: 2024-11-25T17:02:32.200Z

Reserved: 2020-04-30T00:00:00.000Z

Link: CVE-2020-12492

Vulnrichment

Updated: 2024-11-25T17:02:28.635Z

NVD

Status : Received

Published: 2024-11-25T10:21:14.660

Modified: 2024-11-25T10:21:14.660

Link: CVE-2020-12492

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2020-12492", "assignerOrgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8", "state": "PUBLISHED", "assignerShortName": "Vivo", "dateReserved": "2020-04-30T00:00:00.000Z", "datePublished": "2024-11-25T10:11:30.761Z", "dateUpdated": "2024-11-25T17:02:32.200Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Framework", "vendor": "vivo", "versions": [{"status": "affected", "version": "ard11 and below versions released before 2022.2.24"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information.<br>"}], "value": "Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 1, "baseSeverity": "LOW", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8", "shortName": "Vivo", "dateUpdated": "2024-11-25T10:11:30.761Z"}, "references": [{"url": "https://www.vivo.com/en/support/security-advisory-detail?id=12"}], "source": {"discovery": "UNKNOWN"}, "title": "Wifi information acquisition vulnerability in Framework Services", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-25T17:02:20.383757Z", "id": "CVE-2020-12492", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-25T17:02:32.200Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2020-12492", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-25T17:02:20.383757Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-25T17:02:28.635Z"}}], "cna": {"title": "Wifi information acquisition vulnerability in Framework Services", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "vivo", "product": "Framework", "versions": [{"status": "affected", "version": "ard11 and below versions released before 2022.2.24"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.vivo.com/en/support/security-advisory-detail?id=12"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information.", "supportingMedia": [{"type": "text/html", "value": "Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8", "shortName": "Vivo", "dateUpdated": "2024-11-25T10:11:30.761Z"}}}, "cveMetadata": {"cveId": "CVE-2020-12492", "state": "PUBLISHED", "dateUpdated": "2024-11-25T17:02:32.200Z", "dateReserved": "2020-04-30T00:00:00.000Z", "assignerOrgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8", "datePublished": "2024-11-25T10:11:30.761Z", "assignerShortName": "Vivo"}, "dataVersion": "5.1"}