CVE-2020-12624

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-459

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://push32.com/post/dating-app-fail/Exploit, Third Party Advisory
https://push32.com/post/dating-app-fail/Exploit, Third Party Advisory

Timeline

Published: May 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-126256.1An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because CVE-2020-126266.5An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was n CVE-2020-126279.8Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key.CVE-2020-126295.4include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.CVE-2020-12635.5An information disclosure vulnerability exists in the way Windows Error Reporting (WER) handles objects in memory, aka 'Windows Error Report CVE-2020-126356.1XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field.CVE-2020-126379.8Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to rec CVE-2020-126386.8An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTO CVE-2020-126396.1phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.CVE-2020-12647.8An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Eleva CVE-2020-126409.8Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_pl CVE-2020-126419.8rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration set