CVE-2020-24721

An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the persistent state of a private framework.

• http://packetstormsecurity.com/files/159419/Corona-Exposure-Notifications-API-Data-Leakage.htmlThird Party Advisory, VDB Entry
• https://blog.google/inside-google/company-announcements/update-exposure-notificationsVendor Advisory
• https://github.com/minvws/nl-covid19-notification-app-coordination/blob/master/CVEs/CVE-2020-24721.txtThird Party Advisory
• https://seclists.org/fulldisclosure/2020/Sep/53Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/159419/Corona-Exposure-Notifications-API-Data-Leakage.htmlThird Party Advisory, VDB Entry
• https://blog.google/inside-google/company-announcements/update-exposure-notificationsVendor Advisory
• https://github.com/minvws/nl-covid19-notification-app-coordination/blob/master/CVEs/CVE-2020-24721.txtThird Party Advisory
• https://seclists.org/fulldisclosure/2020/Sep/53Mailing List, Third Party Advisory

Published

Sep 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24714The Scalyr Agent before 2.1.10 has Missing SSL Certificate V…9.8
• CVE-2020-24715The Scalyr Agent before 2.1.10 has Missing SSL Certificate V…9.8
• CVE-2020-24716OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execu…7.8
• CVE-2020-24717OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterpret…7.8
• CVE-2020-24718bhyve, as used in FreeBSD through 12.1 and illumos (e.g., Om…8.2
• CVE-2020-24719Exposed Erlang Cookie could lead to Remote Command Execution…9.8
• CVE-2020-24722An issue was discovered in the GAEN (aka Google/Apple Exposu…5.9
• CVE-2020-24723Cross Site Scripting (XSS) vulnerability in the Registration…4.8
• CVE-2020-24736Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and …5.5
• CVE-2020-24739A CSRF vulnerability was found in iCMS v7.0.0 in the backgro…6.5
• CVE-2020-24740An issue was discovered in Pluck 4.7.10-dev2. There is a CSR…4.3
• CVE-2020-24741Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…