What is CVE-2020-12624?

CVE-2020-12624 is a medium-severity vulnerability in Theleague The League, classified under Incomplete Cleanup. CVSS score: 6.5/10. Published 2020-05-03.

How severe is CVE-2020-12624?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Theleague The League

CVE-2020-12624

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions.

EPSS: 0.013 (67.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

Affected products

Theleague The_league
N/a — versions n/a

Weakness classification (CWE)

CWE-459 — Incomplete Cleanup

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-12624?: CVE-2020-12624 is a medium-severity vulnerability in Theleague The League, classified under Incomplete Cleanup. CVSS score: 6.5/10. Published 2020-05-03.
How severe is CVE-2020-12624?: Medium severity. CVSS v3 base score is 6.5 out of 10.