What is CVE-2021-22565?

CVE-2021-22565 is a medium-severity vulnerability in Google Exposure Notification Verification Server, classified under Improper Access Control. CVSS score: 6.5/10. Published 2021-12-09.

How severe is CVE-2021-22565?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Google Exposure Notification Verification Server

CVE-2021-22565

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.

EPSS: 0.004 (34.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.

Affected products

Google Exposure_notification_verification_server
Google Llc Exposure-notifications-verification-server — versions unspecified

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

cve-coordination@google.com (Third Party Advisory, x_refsource_MISC)
cve-coordination@google.com (Patch, Third Party Advisory, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2021-22565?: CVE-2021-22565 is a medium-severity vulnerability in Google Exposure Notification Verification Server, classified under Improper Access Control. CVSS score: 6.5/10. Published 2021-12-09.
How severe is CVE-2021-22565?: Medium severity. CVSS v3 base score is 6.5 out of 10.