CVE-2020-12860

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

COVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information because a BLE device can have four roles and COVIDSafe uses all of them. This allows for re-identification of a device, and potentially identification of the owner's name.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharingThird Party Advisory
https://www.health.gov.au/resources/apps-and-tools/covidsafe-appProduct, Vendor Advisory
https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharingThird Party Advisory
https://www.health.gov.au/resources/apps-and-tools/covidsafe-appProduct, Vendor Advisory

Timeline

Published: May 18, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-128618.8A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to execute CVE-2020-128624.3An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read CVE-2020-128634.3An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read CVE-2020-128644.3An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read CVE-2020-128658.0A heap buffer overflow in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to exec CVE-2020-128665.7A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cau CVE-2020-128675.5A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local netw CVE-2020-128695.4RainbowFish PacsOne Server 6.8.4 allows XSS.CVE-2020-12877.8An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletServi CVE-2020-128709.8RainbowFish PacsOne Server 6.8.4 allows SQL injection on the username parameter in the signup page.CVE-2020-128725.5yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if runnin CVE-2020-128738.8An issue was discovered in Alfresco Enterprise Content Management (ECM) before 6.2.1. A user with privileges to edit a FreeMarker template (