CVE-2020-8792
Last modified
CVE-2020-8792 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has an information-exposure issue. In the mobile app, an attempt to add an already-bound lock by its barcode reveals the email address of the account to which the lock is bound, as well as the name of the lock. EPSS estimates a 0.97% chance of exploitation in the next 30 days.
Description
The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has an information-exposure issue. In the mobile app, an attempt to add an already-bound lock by its barcode reveals the email address of the account to which the lock is bound, as well as the name of the lock. Valid barcode inputs can be easily guessed because barcode strings follow a predictable pattern. Correctly guessed valid barcode inputs entered through the app interface disclose arbitrary users' email addresses and lock names.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Oklok Project | Oklok | 3.1.1 |
References
- https://github.com/fierceoj/ownklokExploit, Third Party Advisory
- https://github.com/fierceoj/ownklokExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-8792?
How severe is CVE-2020-8792?
How do I fix CVE-2020-8792?
Are you affected by CVE-2020-8792?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST