VDB

CVE-2021-31815

CVE-2021-31815 PUBLISHED CVSS 3.299999952316284 LOW

GAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to obtain sensitive information, such as a user's location history, in-person social graph, and (sometimes) COVID-19 infection status, because Rolling Proximity Identifiers and MAC addresses are written to the Android system log, and many Android devices have applications (preinstalled by the hardware manufacturer or network operator) that read system log data and send it to third parties. NOTE: a news outlet (The Markup) states that they received a vendor response indicating that fix deployment "began several weeks ago and will be complete in the coming days."

EPSS 0.13% · 3.0th percentile

Risk Scores

CVSS 3.1
3.299999952316284
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score
0.13%
3.0th percentile

Affected Products

VendorProductVersions
n/an/an/a
googlegoogle\/apple_exposure_notifications0

Timeline

  • Apr 28, 2021 EPSS Score
  • Apr 28, 2021 CVE Published
  • Jul 1, 2021 EPSS Score
  • Sep 2, 2021 EPSS Score
  • Nov 3, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Mar 8, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 9, 2022 EPSS Score
  • Jul 10, 2022 EPSS Score
  • Sep 12, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›