nvd-json-data-feeds/CVE-2020/CVE-2020-274xx/CVE-2020-27414.json

{
  "id": "CVE-2020-27414",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2021-12-02T04:15:06.677",
  "lastModified": "2021-12-03T17:04:51.117",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "Mahavitaran android application 7.50 and prior transmit sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header, MITM or browser history."
    },
    {
      "lang": "es",
      "value": "La aplicaci\u00f3n android Mahavitaran versiones 7.50 y anteriores, transmiten informaci\u00f3n confidencial en los par\u00e1metros de la URL. Esto puede conllevar a una divulgaci\u00f3n de informaci\u00f3n si partes no autorizadas presentan acceso a las URLs por medio de los registros del servidor, el encabezado del referrer, MITM o el historial del navegador"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mahadiscom:mahavitaran:*:*:*:*:*:android:*:*",
              "versionEndIncluding": "7.50",
              "matchCriteriaId": "256E447C-7587-4C12-989F-41E6A197A4F3"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cvewalkthrough.com/cve-2020-27414-mahavitaran-android-application-insecure-communication-of-sensitive-dat/",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}