github.com/google/exposure-notifications-verification-server

2 results · Feed

• Medium 6.5
  CVE-2021-22565

  Insufficient Granularity of Access Control in GAEN Notification Server

  An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.

  Google Google Exposure-notifications-verification-server github.com/google/exposure-notifications-verification-server Go
  Dec 9, 2021
• Medium 6.3
  CVE-2021-22538

  Privilege escalation in RBAC system

  A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has UserWrite permissions and (2) is using a carefully crafted request or malicious proxy, to create ano…

  Google Exposure Notifications Verification Server github.com/google/exposure-notifications-verification-server Go
  Mar 31, 2021