What is CVE-2021-3720?

CVE-2021-3720 is a medium-severity vulnerability in Lenovo Legion Phone2 Pro (L70081), classified under Incorrect Default Permissions. CVSS score: 5.5/10. Published 2021-11-12.

How severe is CVE-2021-3720?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Lenovo Legion Phone2 Pro (L70081)

CVE-2021-3720

An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (L70081) that could allow other applications to access device GPS data.

EPSS: 0.002 (11.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Lenovo Legion Phone2 Pro (L70081) — versions unspecified
Lenovo Legion_phone2_pro_\(l70081\)
Lenovo Legion_phone2_pro_\(l70081\)_firmware
Lenovo Legion Phone Pro (L79031) — versions unspecified
Lenovo Legion_phone_pro_\(l79031\)
Lenovo Legion_phone_pro_\(l79031\)firmware

Weakness classification (CWE)

CWE-276 — Incorrect Default Permissions

References

psirt@lenovo.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-3720?: CVE-2021-3720 is a medium-severity vulnerability in Lenovo Legion Phone2 Pro (L70081), classified under Incorrect Default Permissions. CVSS score: 5.5/10. Published 2021-11-12.
How severe is CVE-2021-3720?: Medium severity. CVSS v3 base score is 5.5 out of 10.