CVE-2020-24721

MEDIUM 5.7CVE-2020-24721 · Published 30/09/2020 · updated 17/06/2026

In short

CVE-2020-24721 is a MEDIUM (CVSS 5.7) vulnerability affecting exposure notifications (apple), exposure notifications (google).
Chance of exploitation in the next 30 days (EPSS): 0.32%, higher than 24.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
exposure notifications apple	`≤ 1.5`	No fix yet
exposure notifications google	`≤ 1.5`	No fix yet

Description

An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the persistent state of a private framework.

References

packetstormsecurity.com/files/159419/Corona-Exposure-Notifications-API-Data-Leakage.html · Third Party Advisory
blog.google/inside-google/company-announcements/update-exposure-notifications · Vendor Advisory
minvws/nl-covid19-notification-app-coordination · Third Party Advisory
seclists.org/fulldisclosure/2020/Sep/53 · Mailing List

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free